Skip to main content
VulnerabilityPublished Updated

CVE-2026-43273: Linux kernel · ceph: supply snapshot context in ceph_zero_partial_object()

Affects Linux kernelSource CVE Database V5

0
Compare

Not known to be exploited · fixed in f16bd3fa74a2084ee7e16a8a2be7e7399b970907 : update Linux kernel when convenient.

Data as of 6 Nov 2026, 15:49 UTC

Severity
Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none
CISA SSVC
Exploitation
No evidence of active exploitation and no public proof of concept
Automatable
Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact
Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch
Available – fixed in f16bd3fa74a2084ee7e16a8a2be7e7399b970907, 36673344b41c31fb502dd0d0113cec1aa96f581e, 757873abfc8ea38592582180aed0f57f0f0cb07a +5

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 6 May 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

ProductAffectedFixed in
LinuxLinuxAffected
  • ≥ ad7a60de882aca31afb58721db166f7e77afcd92, < f16bd3fa74a2084ee7e16a8a2be7e7399b970907
Fixed in
  • f16bd3fa74a2084ee7e16a8a2be7e7399b970907
LinuxLinuxAffected
  • ≥ ad7a60de882aca31afb58721db166f7e77afcd92, < 36673344b41c31fb502dd0d0113cec1aa96f581e
Fixed in
  • 36673344b41c31fb502dd0d0113cec1aa96f581e
LinuxLinuxAffected
  • ≥ ad7a60de882aca31afb58721db166f7e77afcd92, < 757873abfc8ea38592582180aed0f57f0f0cb07a
Fixed in
  • 757873abfc8ea38592582180aed0f57f0f0cb07a
LinuxLinuxAffected
  • ≥ ad7a60de882aca31afb58721db166f7e77afcd92, < 5788b742007f53406049bef917833a71ddd43f60
Fixed in
  • 5788b742007f53406049bef917833a71ddd43f60
LinuxLinuxAffected
  • ≥ ad7a60de882aca31afb58721db166f7e77afcd92, < 4097e70fc543cca72982854108a32f6ae924e727
Fixed in
  • 4097e70fc543cca72982854108a32f6ae924e727
LinuxLinuxAffected
  • ≥ ad7a60de882aca31afb58721db166f7e77afcd92, < 531a76c5a2e44264cee8a70121e63eb28c1ba728
Fixed in
  • 531a76c5a2e44264cee8a70121e63eb28c1ba728

Description

In the Linux kernel, the following vulnerability has been resolved: ceph: supply snapshot context in ceph_zero_partial_object() The ceph_zero_partial_object function was missing proper snapshot context for its OSD write operations, which could lead to data inconsistencies in snapshots. Reproducer: ../src/vstart.sh --new -x --localhost --bluestore ./bin/ceph auth caps client.fs_a mds 'allow rwps fsname=a' mon 'allow r fsname=a' osd 'allow rw tag cephfs data=a' mount -t ceph fs_a@.a=/ /mnt/mycephfs/ -o conf=./ceph.conf dd if=/dev/urandom of=/mnt/mycephfs/foo bs=64K count=1 mkdir /mnt/mycephfs/.snap/snap1 md5sum /mnt/mycephfs/.snap/snap1/foo fallocate -p -o 0 -l 4096 /mnt/mycephfs/foo echo 3 > /proc/sys/vm/drop/caches md5sum /mnt/mycephfs/.snap/snap1/foo # get different md5sum!!

References

Community reviews

Loading reviews…