CVE-2026-68131

A flaw was found in the Linux kernel's rbd component. A corrupted reply to an object map update can cause the rbd_object_map_callback() function to process a positive result code, which is not allowed for write operations. This incorrect handling triggers an assertion in __rbd_obj_handle_request(), leading to a system crash and a Denial of Service (DoS).

An RBD object map update can receive a corrupted positive result code for a write style reply, even though writes must not return a data payload. In the affected path this positive result can be passed through rbd_object_map_callback into __rbd_obj_handle_request and can trigger rbd_assert, causing a kernel crash. For the CVSS the PR:N is used because the attacker does not need a local account on the victim system when acting as a malicious or compromised Ceph OSD endpoint. The issue is network adjacent rather than broadly Internet reachable because RBD and Ceph storage traffic is typically deployed on isolated storage or data center networks. Impact is denial of service only based on the visible primitive, with no supported evidence for information disclosure, integrity corruption, or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.