{"id":"CVE-2026-98634","kind":"vulnerability","aliases":["CVE-2026-98634"],"related":[],"title":"Linux kernel: SCSI zoned disks with too many zones mishandled","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: sd_zbc: Reject disks with too many zones\n\nsd_zbc_read_zones() computes the number of zones with 64-bit arithmetic and\nstores the result in the unsigned int nr_zones field of struct\nzoned_disk_info, silently truncating counts that exceed 32 bits. The\ntruncated count is later used to size per-zone resources, while the device\nmay still report more zones than fit.\n\nMoreover, sd_zbc_report_zones() counts the reported zones with a signed int\nzone_idx, which overflows past INT_MAX. Reject devices reporting more than\nINT_MAX zones at scan time; such a device is not realistic for any medium\nthat exists today, and accepting it produces inconsistent zone bookkeeping.","summary":"The Linux SCSI zoned-block code computes zone counts in 64-bit but stores them in 32-bit fields, and a signed counter overflows past INT_MAX. The fix rejects such disks at scan time, so a device reporting an enormous zone count is refused rather than causing inconsistent bookkeeping.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","scsi","zoned-storage"],"not_affected_if":["no-zoned-scsi-disks"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the sd_zbc fix (the sources do not name a version).","status":"open","published_at":"2026-10-18T16:17:16+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:21:00+00:00","updated_at":"2026-10-25T05:21:00+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:21:00Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the sd_zbc fix (the sources do not name a version).","reach":"local","title":"Linux kernel: SCSI zoned disks with too many zones mishandled","impact":"low","summary":"The Linux SCSI zoned-block code computes zone counts in 64-bit but stores them in 32-bit fields, and a signed counter overflows past INT_MAX. The fix rejects such disks at scan time, so a device reporting an enormous zone count is refused rather than causing inconsistent bookkeeping.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","scsi","zoned-storage"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; kernel bookkeeping inconsistency on a malformed zoned device","analyst_note":"","how_to_check":"- unknown","needs_analyst":false,"not_affected_if":["no-zoned-scsi-disks"],"who_is_affected":"Only hosts with SCSI zoned block devices (ZBC/ZAC, such as host-managed SMR drives) attached are plausibly exposed; the sources do not say whether a remote party can influence the reported zone count. Systems without zoned SCSI disks can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000586,"input_tokens":3484,"output_tokens":475,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98634':13A,16A '32':42B,129C '64':36B,105C 'accept':197C 'arithmet':107C 'bit':37B,43B,106C,130C 'block':30B 'bookkeep':75B,202C 'caus':73B 'code':31B 'comput':32B,99C 'count':34B,68B,126C,133C,158C 'counter':48B 'cve':11A,14A 'devic':63B,145C,174C,186C 'disk':5A,57B,90C,122C 'enorm':66B 'exceed':128C 'exist':194C 'field':44B,118C 'fit':152C 'fix':54B 'follow':81C 'idx':167C 'inconsist':74B,200C 'info':123C 'infrastructur':17B 'int':51B,115C,165C,171C,178C 'kernel':2A,20B,79C 'later':135C 'linux':1A,19B,26B,78C 'linux-kernel':18B 'mani':8A,93C 'max':52B,172C,179C 'may':146C 'medium':192C 'mishandl':10A 'moreov':153C 'nr':116C 'number':101C 'overflow':49B,169C 'past':50B,170C 'per':140C 'per-zon':139C 'produc':199C 'rather':71B 'read':97C 'realist':189C 'refus':70B 'reject':55B,89C,173C 'report':64B,148C,156C,160C,175C 'resolv':85C 'resourc':142C 'result':111C 'scan':59B,182C 'scsi':3A,21B,27B,86C 'sd':87C,95C,154C 'sign':47B,164C 'silent':124C 'size':138C 'still':147C 'storag':24B 'store':39B,109C 'struct':120C 'time':60B,183C 'today':195C 'truncat':125C,132C 'unsign':114C 'use':136C 'vulner':82C 'zbc':88C,96C,155C 'zone':4A,9A,23B,29B,33B,67B,94C,98C,103C,117C,121C,141C,150C,157C,161C,166C,180C,201C 'zoned-block':28B 'zoned-storag':22B","nicknames":[],"mitigations":[],"who_affected":"Only hosts with SCSI zoned block devices (ZBC/ZAC, such as host-managed SMR drives) attached are plausibly exposed; the sources do not say whether a remote party can influence the reported zone count. Systems without zoned SCSI disks can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98634","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98634","severity":null,"published_at":"2026-10-18T16:17:16+00:00","modified_at":"2026-10-19T10:19:27+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}