Skip to main content

Linux Kernel CephFS CVE-2026-43273

| EUVDEUVD-2026-27670 MEDIUM
2026-05-06 Linux GHSA-fcq7-vvcv-2qg9
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Primary impact is snapshot data integrity corruption (I:H); no confidentiality loss or availability denial; local low-privilege access required per the described attack path.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 00:44 vuln.today
CVSS changed
May 08, 2026 - 20:07 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:28 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ceph: supply snapshot context in ceph_zero_partial_object()

The ceph_zero_partial_object function was missing proper snapshot context for its OSD write operations, which could lead to data inconsistencies in snapshots.

Reproducer: ../src/vstart.sh --new -x --localhost --bluestore ./bin/ceph auth caps client.fs_a mds 'allow rwps fsname=a' mon 'allow r fsname=a' osd 'allow rw tag cephfs data=a' mount -t ceph fs_a@.a=/ /mnt/mycephfs/ -o conf=./ceph.conf dd if=/dev/urandom of=/mnt/mycephfs/foo bs=64K count=1 mkdir /mnt/mycephfs/.snap/snap1 md5sum /mnt/mycephfs/.snap/snap1/foo fallocate -p -o 0 -l 4096 /mnt/mycephfs/foo echo 3 > /proc/sys/vm/drop/caches md5sum /mnt/mycephfs/.snap/snap1/foo

get different md5sum!!

AnalysisAI

Snapshot data integrity corruption in the Linux kernel's CephFS driver allows a local authenticated user to silently corrupt immutable snapshot content by performing a fallocate hole-punch operation on a mounted CephFS volume. The ceph_zero_partial_object() function omits the RADOS snapshot context (snapc) when issuing OSD zeroing writes, causing those writes to propagate into snapshot objects rather than being scoped to the live file layer only. Affected environments are limited to those running CephFS mounts with active snapshots; no active exploitation is confirmed (absent from CISA KEV), and EPSS sits at 0.02%, though a developer-supplied reproducer effectively functions as proof-of-concept.

Technical ContextAI

CephFS is the POSIX filesystem layer of the Ceph distributed storage system, exposed in the Linux kernel driver under fs/ceph/. When a hole-punch operation (fallocate -p, i.e. FALLOC_FL_PUNCH_HOLE) is requested, the kernel calls ceph_zero_partial_object() to issue an OSD write that zeroes the affected byte range within the backing RADOS objects. In CephFS, snapshot immutability is enforced by attaching a snapshot context (snapc) to each OSD write operation, which instructs the OSD layer to apply the write only to the live (head) object and not to cloned snapshot objects. The vulnerability is that ceph_zero_partial_object() was issuing these zeroing writes without a valid snapc, causing the OSD to apply the zero-write globally - including into existing snapshot clones - thereby silently corrupting snapshot state. The affected product is identified via CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*. No CWE is officially assigned, but the root cause maps to CWE-665 (Improper Initialization) or CWE-664 (Improper Control of a Resource Through its Lifetime). The tags reference Red Hat and SUSE as distribution-level stakeholders.

RemediationAI

Upgrade to a patched kernel version: Linux 7.0, 6.19.6, 6.18.16, 6.12.75, 6.6.128, 6.1.165, 5.15.202, or 5.10.252. Upstream stable commits are available at https://git.kernel.org/stable/c/36673344b41c31fb502dd0d0113cec1aa96f581e, https://git.kernel.org/stable/c/5788b742007f53406049bef917833a71ddd43f60, and the related stable branch commits linked in the CVE references. Ubuntu users should apply USN-8492-1 (https://ubuntu.com/security/notices/USN-8492-1); Red Hat and SUSE users should consult their respective security advisories. If immediate kernel upgrade is not feasible, restrict the use of fallocate hole-punch operations on CephFS mounts by enforcing a seccomp profile that blocks fallocate with the FALLOC_FL_PUNCH_HOLE flag for untrusted users - note this will prevent applications from reclaiming space via hole-punching. Alternatively, temporarily suspend snapshot creation on volumes where hole-punch workloads are active, reducing exposure until the patch is applied. There are no known workarounds that fully mitigate the root cause without patching.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43273 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy