CVE-2026-68131

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> rbd: Reset positive result codes to zero in object map update path<br /> <br /> In a reply message to an RBD request, a positive result code indicates<br /> a data payload, which is not allowed for writes. While<br /> rbd_osd_req_callback() already resets a positive result code for writes<br /> to zero, rbd_object_map_callback() does not. This allows a corrupted<br /> reply to an object map update to trigger the rbd_assert(*result <br /> __rbd_obj_handle_request() and passes this positive result code. From<br /> __rbd_obj_handle_request(), rbd_obj_advance_write() is called, which<br /> leaves the positive result code unchanged and returns true. Therefore,<br /> the if(done &amp;&amp; *result) branch is executed in __rbd_obj_handle_request()<br /> and the assertion triggers.<br /> <br /> This patch fixes the issue by adjusting the logic in the<br /> rbd_object_map_callback() path. A positive result code for an object map<br /> update is now reset to zero (similar to rbd_osd_req_callback()), and the<br /> message is subsequently handled the same way as if the result code was<br /> zero from the beginning. Additionally, a WARN_ON_ONCE() is added for<br /> this case.