Linux kernel CephFS: num_ops off-by-one on encrypted writeback panics the node under memory pressure

Impact

On an fscrypt-enabled CephFS mount, if a bounce-buffer allocation fails for a dirty folio that is not contiguous with the previous one, ceph_process_folio_batch() has already incremented num_ops but never adds the folio, so ceph_submit_write() hits BUG_ON(ceph_wbc->op_idx + 1 != req->r_num_ops) and panics the kernel. The trigger is ordinary sparse writes to encrypted files plus enough memory pressure to fail an allocation - no crafted input. Any GPU node mounting encrypted CephFS can therefore panic outright while a job is running, losing in-flight work on that node; a tightly packed cluster under memory pressure can lose several at once. The defect dates to 2022 but was masked until multi-folio encrypted writeback was unblocked, so the panic is newly reachable in 6.18.16, 6.19.6 and 7.0-rc1.

Who can reach it

Local user on a node with an fscrypt-enabled CephFS mount who can write to encrypted files; no privilege needed beyond write access. Reaching it requires memory pressure sufficient to fail a bounce-buffer allocation.

What to do

Update the kernel on every CephFS client node to a stable release containing the fix (num_ops decremented when move_dirty_folio_in_page_array() fails after a new extent was counted) and reboot the node - clients cannot be hot-patched here, so drain each node before rebooting. On unpatched nodes the practical mitigation is to avoid fscrypt on CephFS mounts or to keep client memory pressure low; neither is a fix.

References

Related entries

• Linux kernel CephFS client: stale xattr blob size hits a BUG_ON and panics the nodeCVE-2026-52961 · Linux kernel CephFS client (__ceph_build_xattrs_blob)Medium
• Linux amd-pstate - memory leak in amd_pstate_epp_cpu_init(): On failure to set the energy-performance preferenceCVE-2026-53121 · Linux amd-pstate - memory leak in amd_pstate_epp_cpu_init()Medium
• Linux iommu/amd - devid bounds check in __rlookup_amd_iommu(): The AMD IOMMU driver looked up device IDs withoutCVE-2026-53283 · Linux iommu/amd - devid bounds check in __rlookup_amd_iommu()Medium
• Linuxfabrik monitoring plugins: sudo-authorized checks read arbitrary root-readable files via --testCVE-2026-73974 · Linuxfabrik Monitoring Plugins / linuxfabrik-lib (lib.lftest.test --test path handling)Medium
• community.general ipa_getkeytab: IPA/LDAP bind password written to logs and exposed in the process listCVE-2026-80158 · Ansible community.general ipa_getkeytab module (bind_pw not declared no_log)Medium
• Harbor (audit log redaction, LDAP password and OIDC client secret): CREDENTIAL DISCLOSURE VIA THE AUDIT TRAIL: HarborNCVD-2026-058-harbor-audit-log-redaction-ldap · Harbor (audit log redaction, LDAP password and OIDC client secret)Medium