-

CVE-2026-98634

scsi: sd_zbc: Reject disks with too many zones

In the Linux kernel, the following vulnerability has been resolved:

scsi: sd_zbc: Reject disks with too many zones

sd_zbc_read_zones() computes the number of zones with 64-bit arithmetic and
stores the result in the unsigned int nr_zones field of struct
zoned_disk_info, silently truncating counts that exceed 32 bits. The
truncated count is later used to size per-zone resources, while the device
may still report more zones than fit.

Moreover, sd_zbc_report_zones() counts the reported zones with a signed int
zone_idx, which overflows past INT_MAX. Reject devices reporting more than
INT_MAX zones at scan time; such a device is not realistic for any medium
that exists today, and accepting it produces inconsistent zone bookkeeping.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 89d9475610771b5e5fe1879075f0fc9ba6e3755f
Version < d8791ae55d85dfaeafa20ea48365482a0cc5a107
Status affected
Version 89d9475610771b5e5fe1879075f0fc9ba6e3755f
Version < 0af16d8be3ec7ff28bb56a0da79c9aed66ac2c3b
Status affected
Version 89d9475610771b5e5fe1879075f0fc9ba6e3755f
Version < 3ddf8383b54456f19fd73d3cebed81bd250c7388
Status affected
Version 89d9475610771b5e5fe1879075f0fc9ba6e3755f
Version < b6ec0f79745967c751c85df373062c8d15e45fc4
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 4.10
Status affected
Version 0
Version < 4.10
Status unaffected
Version <= 6.12.*
Version 6.12.112
Status unaffected
Version <= 6.18.*
Version 6.18.55
Status unaffected
Version <= 7.2.*
Version 7.2.9
Status unaffected
Version <= *
Version 7.3
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.17% 0.057
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/d8791ae55d85dfaeafa20ea48365482a0cc5a107
https://git.kernel.org/stable/c/0af16d8be3ec7ff28bb56a0da79c9aed66ac2c3b
https://git.kernel.org/stable/c/3ddf8383b54456f19fd73d3cebed81bd250c7388
https://git.kernel.org/stable/c/b6ec0f79745967c751c85df373062c8d15e45fc4