CVE-2026-68131: rbd: Reset positive result codes to zero in object map update path
In the Linux kernel, the following vulnerability has been resolved:
rbd: Reset positive result codes to zero in object map update path
In a reply message to an RBD request, a positive result code indicates a data payload, which is not allowed for writes. While rbdosdreqcallback() already resets a positive result code for writes to zero, rbdobjectmapcallback() does not. This allows a corrupted reply to an object map update to trigger the rbdassert(result < 0) in rbdobjhandlerequest(). This happens, because rbdobjectmapcallback() calls rbdobjhandlerequest() -> rbdobjhandlerequest() and passes this positive result code. From rbdobjhandlerequest(), rbdobjadvancewrite() is called, which leaves the positive result code unchanged and returns true. Therefore, the if(done && result) branch is executed in rbdobjhandlerequest() and the assertion triggers.
This patch fixes the issue by adjusting the logic in the rbdobjectmapcallback() path. A positive result code for an object map update is now reset to zero (similar to rbdosdreqcallback()), and the message is subsequently handled the same way as if the result code was zero from the beginning. Additionally, a WARNONONCE() is added for this case.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68131?
The severity of CVE-2026-68131 is rated at risk level 27.
How do I fix CVE-2026-68131?
To fix CVE-2026-68131, ensure your Linux kernel is updated to the latest version that addresses this vulnerability.
What type of systems are affected by CVE-2026-68131?
CVE-2026-68131 affects systems running vulnerable versions of the Linux kernel that utilize RBD (RADOS Block Device).
Is CVE-2026-68131 a remote exploit vulnerability?
CVE-2026-68131 is not classified as a remote exploit vulnerability but it poses risks related to data integrity in RBD requests.
What impact does CVE-2026-68131 have on data operations?
CVE-2026-68131 can lead to incorrect handling of result codes in data write operations, potentially compromising data integrity.