SB20260812407 - Always-Incorrect Control Flow Implementation in Linux kernel block driver

Description

This security bulletin contains information about 1 vulnerability.

1) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-68131)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of positive result codes in drivers/block/rbd.c when processing a corrupted reply to an object map update request. A remote attacker can send a corrupted reply to trigger an assertion and cause a denial of service.

The issue is triggered in the RBD object map update path for write requests.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/14995c4250f04b58bf6fc00e0e973a2e1b3cfb9b
• https://git.kernel.org/stable/c/2419aa74081007dc4d14ff5640659052dfdfd69a
• https://git.kernel.org/stable/c/34f2a2f32af570dfcc532ad70c080629ee1c32b0
• https://git.kernel.org/stable/c/a6c4250b81bd30beae94e1b7a4b26fa1193ad2e4
• https://git.kernel.org/stable/c/b1a61366933224b3ad80975c4d01ac2cc6931ecf