Live › vulnerability › CVE-2026-98634
Go to dashboardThe Linux SCSI zoned-block code computes zone counts in 64-bit but stores them in 32-bit fields, and a signed counter overflows past INT_MAX. The fix rejects such disks at scan time, so a device reporting an enormous zone count is refused rather than causing inconsistent bookkeeping.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only hosts with SCSI zoned block devices (ZBC/ZAC, such as host-managed SMR drives) attached are plausibly exposed; the sources do not say whether a remote party can influence the reported zone count. Systems without zoned SCSI disks can skip it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
scsi: sd_zbc: Reject disks with too many zones
sd_zbc_read_zones() computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nr_zones field of struct zoned_disk_info, silently truncating counts that exceed 32 bits. The truncated count is later used to size per-zone resources, while the device may still report more zones than fit.
Moreover, sd_zbc_report_zones() counts the reported zones with a signed int zone_idx, which overflows past INT_MAX. Reject devices reporting more than INT_MAX zones at scan time; such a device is not realistic for any medium that exists today, and accepting it produces inconsistent zone bookkeeping.
This page as .md · .json · in your agent: get_signal("CVE-2026-98634")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.