CVE-2026-98634scsi: sd_zbc: Reject disks with too many zones
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: scsi: sd_zbc: Reject disks with too many zones sd_zbc_read_zones() computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nr_zones field of struct zoned_disk_info, silently truncating counts that exceed 32 bits. The truncated count is later used to size per-zone resources, while the device may still report more zones than fit. Moreover, sd_zbc_report_zones() counts the reported zones with a signed int zone_idx, which overflows past INT_MAX. Reject devices reporting more than INT_MAX zones at scan time; such a device is not realistic for any medium that exists today, and accepting it produces inconsistent zone bookkeeping.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from 89d9475610771b5e5fe1879075f0fc9ba6e3755f before d8791ae55d85dfaeafa20ea48365482a0cc5a107; 89d9475610771b5e5fe1879075f0fc9ba6e3755f builds before 0af16d8be3ec7ff28bb56a0da79c9aed66ac2c3b; 89d9475610771b5e5fe1879075f0fc9ba6e3755f builds before 3ddf8383b54456f19fd73d3cebed81bd250c7388; from 89d9475610771b5e5fe1879075f0fc9ba6e3755f before b6ec0f79745967c751c85df373062c8d15e45fc4 | CNA record |
References
- https://git.kernel.org/stable/c/d8791ae55d85dfaeafa20ea48365482a0cc5a107
- https://git.kernel.org/stable/c/0af16d8be3ec7ff28bb56a0da79c9aed66ac2c3b
- https://git.kernel.org/stable/c/3ddf8383b54456f19fd73d3cebed81bd250c7388
- https://git.kernel.org/stable/c/b6ec0f79745967c751c85df373062c8d15e45fc4
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.