Linux Kernel EUVD-2026-32448

Four concurrent conditions are required: (1) a kernel in the affected version range (6.18.16-6.18.29, 6.19.6, or 7.0.x prior to 7.0.4) - earlier stable branches such as 6.6.x contain the latent defect but cannot trigger it; (2) a CephFS mount with fscrypt encryption explicitly enabled - standard unencrypted CephFS mounts are entirely unaffected; (3) the attacker or a process under attacker control has write access to files on that encrypted mount (PR:L); (4) memory pressure sufficient to cause a bounce buffer (ciphertext) allocation failure in the writeback path. Remote unauthenticated exploitation is not possible (AV:L). The vulnerability cannot be triggered without fscrypt; this single configuration prerequisite is the primary limiting factor for most environments.

CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately reflects the threat model: local access with low privileges, pure availability impact via kernel panic, no confidentiality or integrity exposure. EPSS 0.02% (4th percentile) is consistent with the narrow exploitation surface - fscrypt+CephFS is a relatively uncommon deployment combination, and triggering requires inducing memory pressure in addition to write access. The CVE is not listed in CISA KEV, and no public exploit code has been identified. While the Linux kernel is ubiquitous, the compound precondition (specific kernel version range AND fscrypt-enabled CephFS AND memory pressure) significantly narrows the realistic attack surface. The CVSS and EPSS signals are fully consistent. This is a genuine but niche regression - organizations not using fscrypt-encrypted CephFS are not affected at all, and those who are should prioritize patching promptly given the deterministic crash behavior and the reproduction recipe published in the commit message.

A local user with low-privilege write access to an fscrypt-encrypted CephFS mount writes large files using an alternating 4KiB-written/4KiB-skipped pattern, producing discontiguous dirty folios in the page cache. Concurrently, memory pressure (induced by the same or another process allocating memory) causes a kmalloc failure when the writeback path attempts to allocate a bounce buffer for ciphertext. The resulting off-by-one in num_ops triggers the BUG_ON assertion in ceph_submit_write(), panicking the kernel and crashing the host. No public exploit exists, but the commit message provides a precise and complete reproduction recipe.