CVE-2026-46066

A flaw was found in the Linux kernel's Ceph filesystem. When writing to encrypted CephFS files, a failure to allocate a bounce buffer for a dirty folio can lead to an off-by-one error in the num_ops counter. This inconsistency can cause a kernel panic, resulting in a Denial of Service (DoS) for the system. A local user can trigger this by writing to fscrypt-enabled CephFS files under memory pressure.

This vulnerability is rated as having a Moderate impact because exploitation is restricted to local authenticated users, requires the non-default use of file-level encryption on CephFS mounts, and only results in a denial of service without compromising data confidentiality or system integrity. Triggering the crash depends on encountering severe host memory exhaustion during writeback operations on discontiguous file blocks. Standard enterprise environments that do not employ fscrypt on CephFS or do not grant untrusted local users write privileges to these shares remain unaffected by this condition.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.