Answer in brief
CVE-2026-68131 records a High severity (CVSS 7.5) vulnerability in rbd: Reset positive result codes to zero in object map update path. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=22e8bd51bb0469d1a524130a057f894ff632376a <14995c4250f04b58bf6fc00e0e973a2e1b3cfb9b || >=22e8bd51bb0469d1a524130a057f894ff632376a <2419aa74081007dc4d14ff5640659052dfdfd69a || >=22e8bd51bb0469d1a524130a057f894ff632376a <34f2a2f32af570dfcc532ad70c080629ee1c32b0 || >=22e8bd51bb0469d1a524130a057f894ff632376a <b1a61366933224b3ad80975c4d01ac2cc6931ecf || >=22e8bd51bb0469d1a524130a057f894ff632376a <a6c4250b81bd30beae94e1b7a4b26fa1193ad2e4 | 14995c4250f04b58bf6fc00e0e973a2e1b3cfb9b, 2419aa74081007dc4d14ff5640659052dfdfd69a, 34f2a2f32af570dfcc532ad70c080629ee1c32b0, b1a61366933224b3ad80975c4d01ac2cc6931ecf, a6c4250b81bd30beae94e1b7a4b26fa1193ad2e4 |
| Linux/Linuxgeneric | 5.3 | Not reported |
| Linux/Linuxgeneric | >=22e8bd51bb0469d1a524130a057f894ff632376a <cf1167292f606deaddac35ec384eba48f08a68d2 || >=22e8bd51bb0469d1a524130a057f894ff632376a <da926959bf791441ba06a80571708c3d0d3cc08f || >=22e8bd51bb0469d1a524130a057f894ff632376a <6f33d9d539fb94e5a17589c2dfe271ff9bb64904 || >=22e8bd51bb0469d1a524130a057f894ff632376a <14995c4250f04b58bf6fc00e0e973a2e1b3cfb9b || >=22e8bd51bb0469d1a524130a057f894ff632376a <2419aa74081007dc4d14ff5640659052dfdfd69a || >=22e8bd51bb0469d1a524130a057f894ff632376a <34f2a2f32af570dfcc532ad70c080629ee1c32b0 || >=22e8bd51bb0469d1a524130a057f894ff632376a <b1a61366933224b3ad80975c4d01ac2cc6931ecf || >=22e8bd51bb0469d1a524130a057f894ff632376a <a6c4250b81bd30beae94e1b7a4b26fa1193ad2e4 | cf1167292f606deaddac35ec384eba48f08a68d2, da926959bf791441ba06a80571708c3d0d3cc08f, 6f33d9d539fb94e5a17589c2dfe271ff9bb64904, 14995c4250f04b58bf6fc00e0e973a2e1b3cfb9b, 2419aa74081007dc4d14ff5640659052dfdfd69a, 34f2a2f32af570dfcc532ad70c080629ee1c32b0, b1a61366933224b3ad80975c4d01ac2cc6931ecf, a6c4250b81bd30beae94e1b7a4b26fa1193ad2e4 |
Published upstream
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 10, 2026
In the Linux kernel, the following vulnerability has been resolved: rbd: Reset positive result codes to zero in object map update path In a reply message to an RBD request, a positive result code indicates a data payload, which is not allowed for writes. While rbd_osd_req_callback() already resets a positive result code for writes to zero, rbd_object_map_callback() does not. This allows a corrupted reply to an object map update to trigger the rbd_assert(*result < 0) in __rbd_obj_handle_request(). This happens, because rbd_object_map_callback() calls rbd_obj_handle_request() -> __rbd_obj_handle_request() and passes this positive result code. From __rbd_obj_handle_request(), rbd_obj_advance_write() is called, which leaves the positive result code unchanged and returns true. Therefore, the if(done && *result) branch is executed in __rbd_obj_handle_request() and the assertion triggers. This patch fixes the issue by adjusting the logic in the rbd_object_map_callback() path. A positive result code for an object map update is now reset to zero (similar to rbd_osd_req_callback()), and the message is subsequently handled the same way as if the result code was zero from the beginning. Additionally, a WARN_ON_ONCE() is added for this case.
Quoted source text, attributed separately from HOL analysis.