CVE-2026-68131

In the Linux kernel, the following vulnerability has been resolved:

rbd: Reset positive result codes to zero in object map update path

In a reply message to an RBD request, a positive result code indicates a data payload, which is not allowed for writes. While rbdosdreqcallback() already resets a positive result code for writes to zero, rbdobjectmapcallback() does not. This allows a corrupted reply to an object map update to trigger the rbd_assert(*result < 0) in __rbdobjhandlerequest(). This happens, because rbdobjectmapcallback() calls rbdobjhandle_request() -> __rbdobjhandle_request() and passes this positive result code. From __rbdobjhandlerequest(), rbdobjadvancewrite() is called, which leaves the positive result code unchanged and returns true. Therefore, the if(done && *result) branch is executed in _rbdobjhandlerequest() and the assertion triggers.

This patch fixes the issue by adjusting the logic in the rbdobjectmapcallback() path. A positive result code for an object map update is now reset to zero (similar to rbdosdreqcallback()), and the message is subsequently handled the same way as if the result code was zero from the beginning. Additionally, a WARNONONCE() is added for this case.