Linux kernel CephFS client: punch-hole writes without snapshot context silently corrupt existing snapshots

Impact

ceph_zero_partial_object() issued its OSD write operations without supplying a snapshot context, so a hole punched in a live file is applied to data that an existing snapshot should still own. The reproducer in the fix is unambiguous: take a snapshot, fallocate -p the file, drop caches, and the snapshot's checksum changes. For a cluster using CephFS as shared training-data or checkpoint storage this is silent data integrity loss in exactly the copies you keep for recovery - a snapshot you would restore from no longer holds what it did when taken. No privilege boundary is crossed; any tenant that can write to a CephFS mount and whose files are snapshotted can trigger it, including by accident.

Who can reach it

Local, through a mounted CephFS filesystem. Any user with write access to a file on that mount (normal POSIX permissions) can trigger it with fallocate; no elevated privilege and no network access to the cluster is needed.

What to do

Update the kernel on every CephFS client - this is the kernel client, not the Ceph server side, so patching the MDS/OSDs changes nothing. Clients need the stable kernel update and a reboot (or at minimum unmount, module reload, remount, which on a busy GPU node means draining the jobs holding the mount). Treat snapshots taken on an unpatched client as suspect; the fix prevents new divergence and does not repair snapshots already damaged.

References

Related entries

• Linux kernel KVM nSVM: userspace can trigger a kernel WARN by changing CPUID after loading CR3CVE-2026-43315 · Linux kernel KVM nSVM (user-triggerable WARN in svm_set_nested_state)Medium
• Linux kernel scheduler: two yielding tasks can overflow vruntime and destabilize the hostCVE-2026-43323 · Linux kernel sched/fair (zero_vruntime not updated at slice end, EEVDF vruntime overflow)Medium
• Linux kernel BPF: verifier lets a program dereference a nullable map-iterator pointer, crashing the kernelCVE-2026-43333 · Linux kernel BPF verifier (check_mem_access allows direct deref of nullable PTR_TO_BUF)Medium
• Linux kernel Intel uncore PMU: die ID lookup bugs trip a warning and skip PMON unitsCVE-2026-43344 · Linux kernel perf/x86/intel/uncore (die ID init and lookup on Intel SPR/EMR)Medium
• Linux kernel KVM arm64: failed vGIC creation leaves redistributor regions uninitialised for teardownCVE-2026-43351 · Linux kernel KVM arm64 vGIC (dist/redist initialisation on create failure)Medium
• Linux kernel CephFS client: leaked path buffers on error paths exhaust kernel memoryCVE-2026-43419 · Linux kernel CephFS client (ceph_mdsc_build_path error paths)Medium