Live › vulnerability › CVE-2026-98727
Go to dashboardIn the Linux NVMe multipath code, the namespace head is marked zoned before the zone size is known, so a zero zone size can be registered on the path while the head still advertises zoned support. Reporting zones or writing to the head then shifts by ilog2(0), which the sources do not say leads to more than a fault or crash.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems that use NVMe zoned namespaces behind nvme-multipath, where the zone info query reports a zero zone size. Hosts with no zoned NVMe namespaces have no exposure to this path. The sources do not say whether an attacker can trigger it remotely.
No product ranges from the sources yet.
uname -r to get the running kernel versionlsblk -o NAME,ZONED to see whether any NVMe namespace reports a zoned modelEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known
The namespace head is marked zoned at allocation time based only on the command set identifier. If the zone info query reports a zero zone size, the path namespace is registered without zoned limits while the head still advertises the zoned capability with a zone size of zero, and reporting zones or writing to the head then shifts by ilog2(0).
Drop the zoned feature from the head allocation and let the head limits refresh stack it in from the path namespace instead.
This page as .md · .json · in your agent: get_signal("CVE-2026-98727")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.