Executive brief
The Linux kernel's RBD (RADOS Block Device) driver contains a flaw in how it handles response codes from object map update operations. A corrupted network reply with an unexpected positive result code can trigger a kernel assertion failure, causing a denial of service and system crash. This affects systems using RBD for block storage, potentially interrupting data availability.
Technical details
A vulnerability exists in the RBD driver's rbd_object_map_callback() function where positive result codes from object storage replies are not reset to zero before being passed to __rbd_obj_handle_request(). In RBD protocol semantics, positive result codes indicate the presence of a data payload, which is invalid for write operations. The rbd_osd_req_callback() function already implements this reset for standard writes, but the object map update path does not, allowing a malformed or corrupted reply to trigger the rbd_assert(*result < 0) assertion. The vulnerability requires network-level message corruption or an attacker positioned to modify OSD responses. The fix resets positive result codes to zero in the object map update path and adds a WARN_ON_ONCE() to detect the anomalous condition.
Affected products
- Linux Linux Kernel Multiple versions affected; patched in stable branches
Timeline
- 2026-07-09: other: Patch authored by Raphael Zimmer
- 2026-08-03: patched: Patch merged by Greg Kroah-Hartman into stable kernel branches
- 2026-08-10: disclosed: CVE-2026-68131 published on NVD