CVE-2026-98727
Received Received - Intake

NVMe Multipath Zone Info Handling Flaw

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known The namespace head is marked zoned at allocation time based only on the command set identifier. If the zone info query reports a zero zone size, the path namespace is registered without zoned limits while the head still advertises the zoned capability with a zone size of zero, and reporting zones or writing to the head then shifts by ilog2(0). Drop the zoned feature from the head allocation and let the head limits refresh stack it in from the path namespace instead.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98727
EUVD
EUVD-2026-103812

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 28982ad73d6a9605708631dc49a0c763cc398aa2
Linux Linux 28982ad73d6a9605708631dc49a0c763cc398aa2
Linux Linux 28982ad73d6a9605708631dc49a0c763cc398aa2
Linux Linux 28982ad73d6a9605708631dc49a0c763cc398aa2
Linux Linux 6.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect handling of zoned namespace features in the NVMe multipath driver. The namespace head is marked as zoned too early based only on the command set identifier, without confirming zone size. If the zone info query later reports a zero zone size, the system registers the namespace without zoned limits while still advertising zoned capability with a zero zone size. This can lead to incorrect operations like reporting zones or writing data, causing undefined behavior due to division by zero or similar issues.

Detection Guidance

This vulnerability is specific to the Linux kernel's nvme-multipath driver and requires kernel-level inspection. Check if your system uses NVMe multipath with zoned storage by examining kernel logs for nvme errors or zone-related warnings. Commands like dmesg | grep nvme or journalctl -k | grep -i zone may help identify issues.

Impact Analysis

This vulnerability could cause system instability or crashes in systems using NVMe zoned namespaces with multipath. It may lead to data corruption or loss if operations are performed on incorrectly configured zoned devices. Systems relying on proper zoned namespace handling for storage management could experience unexpected failures.

Mitigation Strategies

Update the Linux kernel to a patched version where this issue is resolved. If using NVMe multipath, verify zone configurations and avoid operations on zoned namespaces until the fix is applied. Monitor vendor advisories for kernel updates addressing this CVE.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98727. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart