CVE-2026-98634
Received Received - Intake

Integer Overflow in Linux Kernel SCSI ZBC Handling

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: scsi: sd_zbc: Reject disks with too many zones sd_zbc_read_zones() computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nr_zones field of struct zoned_disk_info, silently truncating counts that exceed 32 bits. The truncated count is later used to size per-zone resources, while the device may still report more zones than fit. Moreover, sd_zbc_report_zones() counts the reported zones with a signed int zone_idx, which overflows past INT_MAX. Reject devices reporting more than INT_MAX zones at scan time; such a device is not realistic for any medium that exists today, and accepting it produces inconsistent zone bookkeeping.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98634
EUVD
EUVD-2026-103548

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 89d9475610771b5e5fe1879075f0fc9ba6e3755f
Linux Linux 89d9475610771b5e5fe1879075f0fc9ba6e3755f
Linux Linux 89d9475610771b5e5fe1879075f0fc9ba6e3755f
Linux Linux 89d9475610771b5e5fe1879075f0fc9ba6e3755f
Linux Linux 4.10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect handling of zone counts in SCSI devices. The code uses 32-bit arithmetic to store zone numbers but may receive 64-bit counts from devices. This causes truncation of large zone numbers, leading to incorrect resource allocation and potential system instability.

Detection Guidance

This vulnerability affects the Linux kernel's SCSI ZBC (Zone Block Command) handling. Detection requires checking kernel logs for zone-related errors or examining disk configurations. Use dmesg | grep -i zone or journalctl -k | grep -i zone to search for zone-related messages. Check disk zone counts with lsblk -o NAME,ZONE or cat /sys/block/sdX/queue/zoned. If zones exceed 32-bit limits, the system may truncate counts.

Impact Analysis

If exploited, this flaw could cause memory corruption or crashes due to improper zone bookkeeping. Systems using SCSI devices with many zones might become unstable or fail unexpectedly.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves the zone count truncation issue. Avoid using devices reporting more than INT_MAX zones, as they are not realistic. Monitor kernel logs for zone-related errors post-update. If affected, replace or reconfigure the problematic storage device.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98634. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart