CVE-2026-68131

In the Linux kernel, the following vulnerability has been resolved:

rbd: Reset positive result codes to zero in object map update path

In a reply message to an RBD request, a positive result code indicates

a data payload, which is not allowed for writes. While

rbd_osd_req_callback() already resets a positive result code for writes

to zero, rbd_object_map_callback() does not. This allows a corrupted

reply to an object map update to trigger the rbd_assert(*result < 0) in

__rbd_obj_handle_request(). This happens, because

rbd_object_map_callback() calls rbd_obj_handle_request() ->

__rbd_obj_handle_request() and passes this positive result code. From

__rbd_obj_handle_request(), rbd_obj_advance_write() is called, which

leaves the positive result code unchanged and returns true. Therefore,

the if(done && *result) branch is executed in __rbd_obj_handle_request()

and the assertion triggers.

This patch fixes the issue by adjusting the logic in the

rbd_object_map_callback() path. A positive result code for an object map

update is now reset to zero (similar to rbd_osd_req_callback()), and the

message is subsequently handled the same way as if the result code was

zero from the beginning. Additionally, a WARN_ON_ONCE() is added for

this case.