CVE-2026-68131 Overview
CVE-2026-68131 is a Linux kernel vulnerability in the RADOS Block Device (RBD) driver. The flaw resides in the rbd_object_map_callback() function, which fails to reset positive result codes to zero when handling replies to object map updates. A corrupted reply from a remote Ceph OSD can trigger the rbd_assert(*result < 0) assertion in __rbd_obj_handle_request(), causing a kernel panic and denial of service. The vulnerability affects systems using RBD to access Ceph storage clusters over the network.
Critical Impact
A malicious or corrupted OSD reply message can trigger a kernel assertion failure, resulting in a denial-of-service condition on hosts using Ceph RBD block devices.
Affected Products
- Linux kernel versions containing the affected drivers/block/rbd.c object map update logic
- Systems using Ceph RADOS Block Device (RBD) clients
- Distributions shipping the vulnerable kernel prior to the referenced stable commits
Discovery Timeline
- 2026-08-10 - CVE-2026-68131 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-68131
Vulnerability Analysis
The vulnerability exists in the Linux kernel RBD driver's object map update handling path. In the RBD protocol, a reply message carrying a positive result code indicates the presence of a data payload, which is not permitted for write operations. The function rbd_osd_req_callback() correctly resets positive result codes to zero for write requests, but rbd_object_map_callback() omits this normalization step.
When a corrupted reply arrives for an object map update, rbd_object_map_callback() forwards the positive result through rbd_obj_handle_request() into __rbd_obj_handle_request(). The function rbd_obj_advance_write() leaves the positive value unchanged and returns true, causing the if (done && *result) branch to execute. This branch reaches rbd_assert(*result < 0), which fails and panics the kernel.
Root Cause
The root cause is missing input normalization in rbd_object_map_callback(). The callback trusts the sign of the result code returned by the OSD without applying the same sanitization performed elsewhere in the driver. This is an improper input validation defect [CWE-20] in kernel network-facing code, permitting a violated assertion invariant to reach the assertion macro.
Attack Vector
An attacker able to inject or manipulate reply traffic between the Linux client and the Ceph OSD can craft a malformed reply to an object map update. Because RBD replies traverse the network, a compromised or malicious OSD, or an attacker positioned on the storage network, can trigger the assertion remotely without authentication to the vulnerable client. Successful exploitation results in a kernel panic on the client host, disrupting availability of workloads dependent on RBD volumes.
No public proof-of-concept code has been released. The vulnerability mechanism is documented in the upstream kernel commits referenced in the Kernel Git commit history.
Detection Methods for CVE-2026-68131
Indicators of Compromise
- Kernel panic messages referencing rbd_assert and __rbd_obj_handle_request in system logs or dmesg output
- Unexpected host reboots on systems mounting Ceph RBD volumes
- WARN_ON_ONCE entries emitted from the RBD object map callback path after patching
Detection Strategies
- Monitor kernel ring buffer and journal logs for RBD-related assertion failures and stack traces containing rbd_object_map_callback.
- Correlate host crashes with active RBD workloads and reply traffic patterns from Ceph OSDs.
- Track kernel package versions across the fleet to identify hosts still running vulnerable RBD driver code.
Monitoring Recommendations
- Alert on repeated kernel panics or BUG_ON/assertion failures on hosts running Ceph clients.
- Inspect network paths between RBD clients and Ceph OSDs for unauthorized endpoints or unexpected reply payloads.
- Baseline RBD reply message result codes and flag anomalous positive values on object map update operations.
How to Mitigate CVE-2026-68131
Immediate Actions Required
- Apply the upstream kernel patches referenced in the stable tree commits, including b1a61366933224b3ad80975c4d01ac2cc6931ecf and related backports.
- Update to a kernel version from your distribution that includes the fix for rbd_object_map_callback().
- Restrict network access to Ceph OSDs to trusted storage segments and authenticated peers.
Patch Information
The fix adjusts rbd_object_map_callback() to reset positive result codes to zero, mirroring the existing behavior in rbd_osd_req_callback(). A WARN_ON_ONCE() is added to surface the anomalous condition without triggering a panic. Patches are available in the mainline and stable kernel trees via the following commits: 14995c4250f0, 2419aa740810, 34f2a2f32af5, a6c4250b81bd, and b1a613669332.
Workarounds
- Isolate Ceph storage traffic on a dedicated, authenticated network segment inaccessible to untrusted hosts.
- Enable and enforce CephX authentication and message signing between clients and OSDs to prevent reply tampering.
- Where feasible, disable the RBD object map feature on volumes accessed by unpatched clients until kernels are updated.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
