CVE-2026-68131: rbd: Reset positive result codes to zero in object map update path

Published Aug 10, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

rbd: Reset positive result codes to zero in object map update path

In a reply message to an RBD request, a positive result code indicates a data payload, which is not allowed for writes. While rbdosdreqcallback() already resets a positive result code for writes to zero, rbdobjectmapcallback() does not. This allows a corrupted reply to an object map update to trigger the rbdassert(result < 0) in rbdobjhandlerequest(). This happens, because rbdobjectmapcallback() calls rbdobjhandlerequest() -> rbdobjhandlerequest() and passes this positive result code. From rbdobjhandlerequest(), rbdobjadvancewrite() is called, which leaves the positive result code unchanged and returns true. Therefore, the if(done && result) branch is executed in rbdobjhandlerequest() and the assertion triggers.

This patch fixes the issue by adjusting the logic in the rbdobjectmapcallback() path. A positive result code for an object map update is now reset to zero (similar to rbdosdreqcallback()), and the message is subsequently handled the same way as if the result code was zero from the beginning. Additionally, a WARNONONCE() is added for this case.

Affected Software

1 affected component
Linux Kernel

Event History

Aug 10, 2026
CVE Published
via MITRE·11:58 AM
Data Sourced
via MITRE·11:58 AM
Description
Data Sourced
via NVD·01:19 PM
Description
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-68131?

The severity of CVE-2026-68131 is rated at risk level 27.

2

How do I fix CVE-2026-68131?

To fix CVE-2026-68131, ensure your Linux kernel is updated to the latest version that addresses this vulnerability.

3

What type of systems are affected by CVE-2026-68131?

CVE-2026-68131 affects systems running vulnerable versions of the Linux kernel that utilize RBD (RADOS Block Device).

4

Is CVE-2026-68131 a remote exploit vulnerability?

CVE-2026-68131 is not classified as a remote exploit vulnerability but it poses risks related to data integrity in RBD requests.

5

What impact does CVE-2026-68131 have on data operations?

CVE-2026-68131 can lead to incorrect handling of result codes in data write operations, potentially compromising data integrity.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203