Linux kernel CephFS: folios skipped for writeback are never put, leaking page references

Impact

CephFS writeback collects folios with filemap_get_folios(), which takes a reference on each, but folios removed from the batch because they are not suitable for writeback were dropped without folio_put(). Each occurrence pins a page permanently. On a node that writes heavily to CephFS - checkpoint and log traffic from training jobs - free memory erodes over time until allocations fail, and the only recovery is a reboot. The record is a one-paragraph fix tested on v6.18 and makes no claim beyond the leaked references; it is a resource-exhaustion defect, not memory corruption.

Who can reach it

Local workload on a node with CephFS mounted in-kernel; any tenant that can write files to the mount drives writeback. No special privilege is needed beyond write access to the filesystem.

What to do

Move to a stable kernel containing the folio_put() fix (three stable commits are linked; the record names no fixed version). That is a kernel change: drain the node and reboot. There is no runtime mitigation other than reducing CephFS write pressure and rebooting nodes whose free memory has already drifted.

References

Related entries

• Linux kernel (net/tls): When kTLS RX offload fails at tls_dev_add, the rollback frees the software context but neverCVE-2026-52974 · Linux kernel (net/tls)High
• OpenSSL DTLS: buffering future-epoch records retains a full 16 KB read buffer each, ~1200x memory amplificationCVE-2026-54874 · OpenSSL DTLS record layer (future-epoch record buffering during handshake)High
• OpenSSL: memory leak per handshake when a server staples an OCSP response with no entriesCVE-2026-54876 · OpenSSL X.509 verification (OCSP stapled-response check, X509_V_FLAG_OCSP_RESP_CHECK)High
• libssh: incorrect AES-GCM finalization removes integrity protection on SSH sessionsCVE-2026-59847 · libssh (AES-GCM finalization check, OpenSSL backend)High
• Xen (vRTC): Out-of-bounds read in vRTC emulation - hypervisor memory disclosure to a guestCVE-2026-62430 · Xen (vRTC)High
• OpenSSL: crafted CMS message causes an 8-byte out-of-bounds heap write during CMS_decrypt()CVE-2026-63072 · OpenSSL CMS decryption (AES-WRAP-PAD key unwrap output buffer)High