Sentry: store_raft.go:559: log.Fatal: while applying snapshot: while ingesting [× × × × × × × ×] and excising /Table/117/1/×/×-/Max: link × ×: permission denied (1) attached stack trace ...

This issue was auto filed by Sentry. It represents a crash or reported error on a live cluster with telemetry enabled.

Sentry Link: [https://cockroach-labs.sentry.io/issues/7628896064/?referrer=webhooks_plugin](https://cockroach-labs.sentry.io/issues/7628896064/?referrer=webhooks_plugin)

Panic Message:

```
store_raft.go:559: log.Fatal: while applying snapshot: while ingesting [× × × × × × × ×] and excising /Table/117/1/×/×-/Max: link × ×: permission denied
(1) attached stack trace
-- stack trace:
| github.com/cockroachdb/cockroach/pkg/kv/kvserver.(*Store).processRaftSnapshotRequest.func1
| pkg/kv/kvserver/store_raft.go:559
| github.com/cockroachdb/cockroach/pkg/kv/kvserver.(*Store).withReplicaForRequest
| pkg/kv/kvserver/store_raft.go:435
| github.com/cockroachdb/cockroach/pkg/kv/kvserver.(*Store).processRaftSnapshotRequest
| pkg/kv/kvserver/store_raft.go:499
| github.com/cockroachdb/cockroach/pkg/kv/kvserver.(*Store).receiveSnapshot
| pkg/kv/kvserver/store_snapshot.go:603
| github.com/cockroachdb/cockroach/pkg/kv/kvserver.(*Store).HandleSnapshot.func1
| pkg/kv/kvserver/store_raft.go:282
| github.com/cockroachdb/cockroach/pkg/util/stop.(*Stopper).RunTaskWithErr
| pkg/util/stop/stopper.go:350
| github.com/cockroachdb/cockroach/pkg/kv/kvserver.(*Store).HandleSnapshot
| pkg/kv/kvserver/store_raft.go:279
| github.com/cockroachdb/cockroach/pkg/kv/kvserver.(*RaftTransport).RaftSnapshot
| pkg/kv/kvserver/raft_transport.go:638
| github.com/cockroachdb/cockroach/pkg/kv/kvserver._MultiRaft_RaftSnapshot_Handler
| bazel-out/k8-opt/bin/pkg/kv/kvserver/kvserver_go_proto_/github.com/cockroachdb/cockroach/pkg/kv/kvserver/storage_services.pb.go:267
| github.com/cockroachdb/cockroach/pkg/rpc.NewServerEx.StreamServerInterceptor.func13
| pkg/util/tracing/grpcinterceptor/grpc_interceptor.go:159
| google.golang.org/grpc.getChainStreamHandler.func1
| external/org_golang_google_grpc/server.go:1504
| github.com/cockroachdb/cockroach/pkg/rpc.NewServerEx.func4
| pkg/rpc/context.go:181
| google.golang.org/grpc.getChainStreamHandler.func1
| external/org_golang_google_grpc/server.go:1504
| github.com/cockroachdb/cockroach/pkg/rpc.kvAuth.streamInterceptor
| pkg/rpc/auth.go:152
| google.golang.org/grpc.getChainStreamHandler.func1
| external/org_golang_google_grpc/server.go:1504
| github.com/cockroachdb/cockroach/pkg/rpc.NewServerEx.func2.1
| pkg/rpc/context.go:142
| github.com/cockroachdb/cockroach/pkg/util/stop.(*Stopper).RunTaskWithErr
| pkg/util/stop/stopper.go:350
| github.com/cockroachdb/cockroach/pkg/rpc.NewServerEx.func2
| pkg/rpc/context.go:141
| google.golang.org/grpc.NewServer.chainStreamServerInterceptors.chainStreamInterceptors.func2
| external/org_golang_google_grpc/server.go:1495
| google.golang.org/grpc.(*Server).processStreamingRPC
| external/org_golang_google_grpc/server.go:1659
| google.golang.org/grpc.(*Server).handleStream
| external/org_golang_google_grpc/server.go:1739
| google.golang.org/grpc.(*Server).serveStreams.func1.1
| external/org_golang_google_grpc/server.go:970
| runtime.goexit
| src/runtime/asm_arm64.s:1223
Wraps: (2) secondary error attachment
| while applying snapshot: while ingesting [× × × × × × × ×] and excising /Table/117/1/×/×-/Max: link × ×: permission denied
| (1) attached stack trace
| -- stack trace:
| | github.com/cockroachdb/cockroach/pkg/kv/kvserver.(*Replica).handleRaftReadyRaftMuLocked
| | pkg/kv/kvserver/replica_raft.go:1191
| | github.com/cockroachdb/cockroach/pkg/kv/kvserver.(*Store).processRaftSnapshotRequest.func1
| | pkg/kv/kvserver/store_raft.go:558
| | github.com/cockroachdb/cockroach/pkg/kv/kvserver.(*Store).withReplicaForRequest
| | pkg/kv/kvserver/store_raft.go:435
| | github.com/cockroachdb/cockroach/pkg/kv/kvserver.(*Store).processRaftSnapshotRequest
| | pkg/kv/kvserver/store_raft.go:499
| | github.com/cockroachdb/cockroach/pkg/kv/kvserver.(*Store).receiveSnapshot
| | pkg/kv/kvserver/store_snapshot.go:603
| | github.com/cockroachdb/cockroach/pkg/kv/kvserver.(*Store).HandleSnapshot.func1
| | pkg/kv/kvserver/store_raft.go:282
| | github.com/cockroachdb/cockroach/pkg/util/stop.(*Stopper).RunTaskWithErr
| | pkg/util/stop/stopper.go:350
| | github.com/cockroachdb/cockroach/pkg/kv/kvserver.(*Store).HandleSnapshot
| | pkg/kv/kvserver/store_raft.go:279
| | github.com/cockroachdb/cockroach/pkg/kv/kvserver.(*RaftTransport).RaftSnapshot
| | pkg/kv/kvserver/raft_transport.go:638
| | github.com/cockroachdb/cockroach/pkg/kv/kvserver._MultiRaft_RaftSnapshot_Handler
| | bazel-out/k8-opt/bin/pkg/kv/kvserver/kvserver_go_proto_/github.com/cockroachdb/cockroach/pkg/kv/kvserver/storage_services.pb.go:267
| | github.com/cockroachdb/cockroach/pkg/rpc.NewServerEx.StreamServerInterceptor.func13
| | pkg/util/tracing/grpcinterceptor/grpc_interceptor.go:159
| | google.golang.org/grpc.getChainStreamHandler.func1
| | external/org_golang_google_grpc/server.go:1504
| | github.com/cockroachdb/cockroach/pkg/rpc.NewServerEx.func4
| | pkg/rpc/context.go:181
| | google.golang.org/grpc.getChainStreamHandler.func1
| | external/org_golang_google_grpc/server.go:1504
| | github.com/cockroachdb/cockroach/pkg/rpc.kvAuth.streamInterceptor
| | pkg/rpc/auth.go:152
| | google.golang.org/grpc.getChainStreamHandler.func1
| | external/org_golang_google_grpc/server.go:1504
| | github.com/cockroachdb/cockroach/pkg/rpc.NewServerEx.func2.1
| | pkg/rpc/context.go:142
| | github.com/cockroachdb/cockroach/pkg/util/stop.(*Stopper).RunTaskWithErr
| | pkg/util/stop/stopper.go:350
| | github.com/cockroachdb/cockroach/pkg/rpc.NewServerEx.func2
| | pkg/rpc/context.go:141
| | google.golang.org/grpc.NewServer.chainStreamServerInterceptors.chainStreamInterceptors.func2
| | external/org_golang_google_grpc/server.go:1495
| | google.golang.org/grpc.(*Server).processStreamingRPC
| | external/org_golang_google_grpc/server.go:1659
| | google.golang.org/grpc.(*Server).handleStream
| | external/org_golang_google_grpc/server.go:1739
| | google.golang.org/grpc.(*Server).serveStreams.func1.1
| | external/org_golang_google_grpc/server.go:970
| Wraps: (2) while applying snapshot
| Wraps: (3) attached stack trace
| -- stack trace:
| | github.com/cockroachdb/cockroach/pkg/kv/kvserver.(*Replica).applySnapshot
| | pkg/kv/kvserver/replica_raftstorage.go:607
| | github.com/cockroachdb/cockroach/pkg/kv/kvserver.(*Replica).handleRaftReadyRaftMuLocked
| | pkg/kv/kvserver/replica_raft.go:1190
| | github.com/cockroachdb/cockroach/pkg/kv/kvserver.(*Store).processRaftSnapshotRequest.func1
| | pkg/kv/kvserver/store_raft.go:558
| | github.com/cockroachdb/cockroach/pkg/kv/kvserver.(*Store).withReplicaForRequest
| | pkg/kv/kvserver/store_raft.go:435
| | github.com/cockroachdb/cockroach/pkg/kv/kvserver.(*Store).processRaftSnapshotRequest
| | pkg/kv/kvserver/store_raft.go:499
| | github.com/cockroachdb/cockroach/pkg/kv/kvserver.(*Store).receiveSnapshot
| | pkg/kv/kvserver/store_snapshot.go:603
| | github.com/cockroachdb/cockroach/pkg/kv/kvserver.(*Store).HandleSnapshot.func1
| | pkg/kv/kvserver/store_raft.go:282
| | github.com/cockroachdb/cockroach/pkg/util/stop.(*Stopper).RunTaskWithErr
| | pkg/util/stop/stopper.go:350
| | github.com/cockroachdb/cockroach/pkg/kv/kvserver.(*Store).HandleSnapshot
| | pkg/kv/kvserver/store_raft.go:279
| | github.com/cockroachdb/cockroach/pkg/kv/kvserver.(*RaftTransport).RaftSnapshot
| | pkg/kv/kvserver/raft_transport.go:638
| | github.com/cockroachdb/cockroach/pkg/kv/kvserver._MultiRaft_RaftSnapshot_Handler
| | bazel-out/k8-opt/bin/pkg/kv/kvserver/kvserver_go_proto_/github.com/cockroachdb/cockroach/pkg/kv/kvserver/storage_services.pb.go:267
| | github.com/cockroachdb/cockroach/pkg/rpc.NewServerEx.StreamServerInterceptor.func13
| | pkg/util/tracing/grpcinterceptor/grpc_interceptor.go:159
| | google.golang.org/grpc.getChainStreamHandler.func1
| | external/org_golang_google_grpc/server.go:1504
| | github.com/cockroachdb/cockroach/pkg/rpc.NewServerEx.func4
| | pkg/rpc/context.go:181
| | google.golang.org/grpc.getChainStreamHandler.func1
| | external/org_golang_google_grpc/server.go:1504
| | github.com/cock...
```

Stacktrace (expand for inline code snippets):

[src/runtime/asm_arm64.s#L1222-L1224](src/runtime/asm_arm64.s#L1222-L1224)
[external/org_golang_google_grpc/server.go#L969-L971](external/org_golang_google_grpc/server.go#L969-L971)
[external/org_golang_google_grpc/server.go#L1738-L1740](external/org_golang_google_grpc/server.go#L1738-L1740)
[external/org_golang_google_grpc/server.go#L1658-L1660](external/org_golang_google_grpc/server.go#L1658-L1660)
[external/org_golang_google_grpc/server.go#L1494-L1496](external/org_golang_google_grpc/server.go#L1494-L1496)
[pkg/rpc/context.go#L140-L142](pkg/rpc/context.go#L140-L142)
[pkg/util/stop/stopper.go#L349-L351](pkg/util/stop/stopper.go#L349-L351)
[pkg/rpc/context.go#L141-L143](pkg/rpc/context.go#L141-L143)
[external/org_golang_google_grpc/server.go#L1503-L1505](external/org_golang_google_grpc/server.go#L1503-L1505)
[pkg/rpc/auth.go#L151-L153](pkg/rpc/auth.go#L151-L153)
[external/org_golang_google_grpc/server.go#L1503-L1505](external/org_golang_google_grpc/server.go#L1503-L1505)
[pkg/rpc/context.go#L180-L182](pkg/rpc/context.go#L180-L182)
[external/org_golang_google_grpc/server.go#L1503-L1505](external/org_golang_google_grpc/server.go#L1503-L1505)
[pkg/util/tracing/grpcinterceptor/grpc_interceptor.go#L158-L160](pkg/util/tracing/grpcinterceptor/grpc_interceptor.go#L158-L160)
[bazel-out/k8-opt/bin/pkg/kv/kvserver/kvserver_go_proto_/https://github.com/cockroachdb/cockroach/blob/adfe5601ff6cb72c0f65090995978ca9ebbdc647/pkg/kv/kvserver/storage_services.pb.go#L266-L268](bazel-out/k8-opt/bin/pkg/kv/kvserver/kvserver_go_proto_/https://github.com/cockroachdb/cockroach/blob/adfe5601ff6cb72c0f65090995978ca9ebbdc647/pkg/kv/kvserver/storage_services.pb.go#L266-L268)
[pkg/kv/kvserver/raft_transport.go#L637-L639](pkg/kv/kvserver/raft_transport.go#L637-L639)
[pkg/kv/kvserver/store_raft.go#L278-L280](pkg/kv/kvserver/store_raft.go#L278-L280)
[pkg/util/stop/stopper.go#L349-L351](pkg/util/stop/stopper.go#L349-L351)
[pkg/kv/kvserver/store_raft.go#L281-L283](pkg/kv/kvserver/store_raft.go#L281-L283)
[pkg/kv/kvserver/store_snapshot.go#L602-L604](pkg/kv/kvserver/store_snapshot.go#L602-L604)
[pkg/kv/kvserver/store_raft.go#L498-L500](pkg/kv/kvserver/store_raft.go#L498-L500)
[pkg/kv/kvserver/store_raft.go#L434-L436](pkg/kv/kvserver/store_raft.go#L434-L436)
[pkg/kv/kvserver/store_raft.go#L558-L560](pkg/kv/kvserver/store_raft.go#L558-L560)

```
src/runtime/asm_arm64.s in runtime.goexit at line 1223
external/org_golang_google_grpc/server.go in google.golang.org/grpc.(*Server).serveStreams.func1.1 at line 970
external/org_golang_google_grpc/server.go in google.golang.org/grpc.(*Server).handleStream at line 1739
external/org_golang_google_grpc/server.go in google.golang.org/grpc.(*Server).processStreamingRPC at line 1659
external/org_golang_google_grpc/server.go in google.golang.org/grpc.NewServer.chainStreamServerInterceptors.chainStreamInterceptors.func2 at line 1495
pkg/rpc/context.go in pkg/rpc.NewServerEx.func2 at line 141
pkg/util/stop/stopper.go in pkg/util/stop.(*Stopper).RunTaskWithErr at line 350
pkg/rpc/context.go in pkg/rpc.NewServerEx.func2.1 at line 142
external/org_golang_google_grpc/server.go in google.golang.org/grpc.getChainStreamHandler.func1 at line 1504
pkg/rpc/auth.go in pkg/rpc.kvAuth.streamInterceptor at line 152
external/org_golang_google_grpc/server.go in google.golang.org/grpc.getChainStreamHandler.func1 at line 1504
pkg/rpc/context.go in pkg/rpc.NewServerEx.func4 at line 181
external/org_golang_google_grpc/server.go in google.golang.org/grpc.getChainStreamHandler.func1 at line 1504
pkg/util/tracing/grpcinterceptor/grpc_interceptor.go in pkg/rpc.NewServerEx.StreamServerInterceptor.func13 at line 159
bazel-out/k8-opt/bin/pkg/kv/kvserver/kvserver_go_proto_/github.com/cockroachdb/cockroach/pkg/kv/kvserver/storage_services.pb.go in pkg/kv/kvserver._MultiRaft_RaftSnapshot_Handler at line 267
pkg/kv/kvserver/raft_transport.go in pkg/kv/kvserver.(*RaftTransport).RaftSnapshot at line 638
pkg/kv/kvserver/store_raft.go in pkg/kv/kvserver.(*Store).HandleSnapshot at line 279
pkg/util/stop/stopper.go in pkg/util/stop.(*Stopper).RunTaskWithErr at line 350
pkg/kv/kvserver/store_raft.go in pkg/kv/kvserver.(*Store).HandleSnapshot.func1 at line 282
pkg/kv/kvserver/store_snapshot.go in pkg/kv/kvserver.(*Store).receiveSnapshot at line 603
pkg/kv/kvserver/store_raft.go in pkg/kv/kvserver.(*Store).processRaftSnapshotRequest at line 499
pkg/kv/kvserver/store_raft.go in pkg/kv/kvserver.(*Store).withReplicaForRequest at line 435
pkg/kv/kvserver/store_raft.go in pkg/kv/kvserver.(*Store).processRaftSnapshotRequest.func1 at line 559
```

### Tags

| Tag | Value |
| --- | --- |
| Command | server |
| Environment | v25.2.3 |
| Go Version | go1.23.7 X:nocoverageredesign |
| Platform | linux arm64 |
| Distribution | CCL |
| Cockroach Release | v25.2.3 |
| Cockroach SHA | adfe5601ff6cb72c0f65090995978ca9ebbdc647 |
| # of CPUs | 2 |
| # of Goroutines | 493 |

Jira issue: CRDB-66019

Start by reading pkg/kv/kvserver/replica_raftstorage.go at applySnapshot and follow the callers in replica_raft.go, store_raft.go, and store_snapshot.go named in the trace. Use the Sentry report to understand the permission-denied failure during Raft snapshot ingestion; done means the crash is reproducible, its cause is established, and snapshot application handles this case safely.

Written by the indexing model from the issue text.