{ "cveId": "CVE-2026-46066", "url": "https://patchblox.com/security/cve/CVE-2026-46066", "summary": "CVE-2026-46066 is fixed in 19 products on 1 platform, first by ALAS2023-2026-1754, released May 25, 2026. It is not reported as exploited. Patch Radar priority: Routine.", "title": "ceph: fix num_ops off-by-one when crypto allocation fails", "description": "In the Linux kernel, the following vulnerability has been resolved: ceph: fix num_ops off-by-one when crypto allocation fails move_dirty_folio_in_page_array() may fail if the file is encrypted, the dirty folio is not the first in the batch, and it fails to allocate a bounce buffer to hold the ciphertext. When that happens, ceph_process_folio_batch() simply redirties the folio and flushes the current batch -- it can retry that folio in a future batch. However, if this failed folio is not contiguous with the last folio that did make it into the batch, then ceph_process_folio_batch() has already incremented \u0060ceph_wbc-\u003Enum_ops\u0060; because it doesn\u0027t follow through and add the discontiguous folio to the array, ceph_submit_write() -- which expects that \u0060ceph_wbc-\u003Enum_ops\u0060 accurately reflects the number of contiguous ranges (and therefore the required number of \u0022write extent\u0022 ops) in the writeback -- will panic the kernel: BUG_ON(ceph_wbc-\u003Eop_idx \u002B 1 != req-\u003Er_num_ops); This issue can be reproduced on affected kernels by writing to fscrypt-enabled CephFS file(s) with a 4KiB-written/4KiB-skipped/repeat pattern (total filesize should not matter) and gradually increasing the system\u0027s memory pressure until a bounce buffer allocation fails. Fix this crash by decrementing \u0060ceph_wbc-\u003Enum_ops\u0060 back to the correct value when move_dirty_folio_in_page_array() fails, but the folio already started counting a new (i.e. still-empty) extent. The defect corrected by this patch has existed since 2022 (see first \u0060Fixes:\u0060), but another bug blocked multi-folio encrypted writeback until recently (see second \u0060Fixes:\u0060). The second commit made it into 6.18.16, 6.19.6, and 7.0-rc1, unmasking the panic in those versions. This patch therefore fixes a regression (panic) introduced by cac190c7674f.", "published": "2026-05-25T09:00:00Z", "severity": "Moderate", "cvss": 5.5, "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cwe": "Off-by-one Error", "epss": 0.00122, "epssPercentile": 0.02019, "priority": "Routine", "priorityTier": 4, "exploited": false, "vendorExploited": false, "disclosed": false, "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-46066", "fixes": [ { "platform": "linux", "product": "bpftool6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.30-61.116.amzn2023", "fix": "ALAS2023-2026-1754", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1754", "released": "2026-05-25T09:00:00Z" }, { "platform": "linux", "product": "bpftool6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.30-61.116.amzn2023", "fix": "ALAS2023-2026-1754", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1754", "released": "2026-05-25T09:00:00Z" }, { "platform": "linux", "product": "kernel-livepatch-6.18.30-61.116", "release": "amzn 2023", "fixedVersion": "1:1.0-0.amzn2023", "fix": "ALAS2023-2026-1754", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1754", "released": "2026-05-25T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.30-61.116.amzn2023", "fix": "ALAS2023-2026-1754", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1754", "released": "2026-05-25T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.30-61.116.amzn2023", "fix": "ALAS2023-2026-1754", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1754", "released": "2026-05-25T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo-common-aarch64", "release": "amzn 2023", "fixedVersion": "1:6.18.30-61.116.amzn2023", "fix": "ALAS2023-2026-1754", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1754", "released": "2026-05-25T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo-common-x86_64", "release": "amzn 2023", "fixedVersion": "1:6.18.30-61.116.amzn2023", "fix": "ALAS2023-2026-1754", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1754", "released": "2026-05-25T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-devel", "release": "amzn 2023", "fixedVersion": "1:6.18.30-61.116.amzn2023", "fix": "ALAS2023-2026-1754", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1754", "released": "2026-05-25T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-headers", "release": "amzn 2023", "fixedVersion": "1:6.18.30-61.116.amzn2023", "fix": "ALAS2023-2026-1754", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1754", "released": "2026-05-25T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-modules-extra", "release": "amzn 2023", "fixedVersion": "1:6.18.30-61.116.amzn2023", "fix": "ALAS2023-2026-1754", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1754", "released": "2026-05-25T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-modules-extra-common", "release": "amzn 2023", "fixedVersion": "1:6.18.30-61.116.amzn2023", "fix": "ALAS2023-2026-1754", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1754", "released": "2026-05-25T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-tools", "release": "amzn 2023", "fixedVersion": "1:6.18.30-61.116.amzn2023", "fix": "ALAS2023-2026-1754", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1754", "released": "2026-05-25T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-tools-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.30-61.116.amzn2023", "fix": "ALAS2023-2026-1754", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1754", "released": "2026-05-25T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-tools-devel", "release": "amzn 2023", "fixedVersion": "1:6.18.30-61.116.amzn2023", "fix": "ALAS2023-2026-1754", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1754", "released": "2026-05-25T09:00:00Z" }, { "platform": "linux", "product": "linux", "release": "Debian 13.5 (trixie)", "fixedVersion": "6.12.115-2", "fix": "DEBIAN-CVE-2026-46066", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-46066", "released": "2026-05-27T17:38:13Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "7.0.4-1", "fix": "DEBIAN-CVE-2026-46066", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-46066", "released": "2026-05-27T17:38:13Z" }, { "platform": "linux", "product": "perf6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.30-61.116.amzn2023", "fix": "ALAS2023-2026-1754", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1754", "released": "2026-05-25T09:00:00Z" }, { "platform": "linux", "product": "perf6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.30-61.116.amzn2023", "fix": "ALAS2023-2026-1754", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1754", "released": "2026-05-25T09:00:00Z" }, { "platform": "linux", "product": "python3-perf6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.30-61.116.amzn2023", "fix": "ALAS2023-2026-1754", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1754", "released": "2026-05-25T09:00:00Z" }, { "platform": "linux", "product": "python3-perf6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.30-61.116.amzn2023", "fix": "ALAS2023-2026-1754", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1754", "released": "2026-05-25T09:00:00Z" } ], "noFixYet": [], "dataAsOf": "2026-11-08T13:06:02Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }