CVE-2026-68131

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

rbd: Reset positive result codes to zero in object map update path

In a reply message to an RBD request, a positive result code indicates

a data payload, which is not allowed for writes. While

rbd_osd_req_callback() already resets a positive result code for writes

to zero, rbd_object_map_callback() does not. This allows a corrupted

reply to an object map update to trigger the rbd_assert(*result < 0) in

__rbd_obj_handle_request(). This happens, because

rbd_object_map_callback() calls rbd_obj_handle_request() ->

__rbd_obj_handle_request() and passes this positive result code. From

__rbd_obj_handle_request(), rbd_obj_advance_write() is called, which

leaves the positive result code unchanged and returns true. Therefore,

the if(done && *result) branch is executed in __rbd_obj_handle_request()

and the assertion triggers.

This patch fixes the issue by adjusting the logic in the

rbd_object_map_callback() path. A positive re

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References