CVE-2026-98634: scsi: sd_zbc: Reject disks with too many zones
In the Linux kernel, the following vulnerability has been resolved:
scsi: sdzbc: Reject disks with too many zones
sdzbcreadzones() computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nrzones field of struct zoneddiskinfo, silently truncating counts that exceed 32 bits. The truncated count is later used to size per-zone resources, while the device may still report more zones than fit.
Moreover, sdzbcreportzones() counts the reported zones with a signed int zoneidx, which overflows past INTMAX. Reject devices reporting more than INTMAX zones at scan time; such a device is not realistic for any medium that exists today, and accepting it produces inconsistent zone bookkeeping.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Reject disks or devices reporting more than INT_MAX zones.
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
Only Linux systems scanning zoned SCSI disks that report more than INT_MAX zones are affected. The fix notes that no medium existing today is realistically expected to have that many zones.
What condition is required to trigger the faulty bookkeeping?
The disk must report a zone count exceeding the range safely handled by the kernel's zone-count fields and reporting index. This occurs during device scan and zone reporting, before per-zone resources are sized from the truncated count.
What happens after applying the fix?
The kernel rejects a disk at scan time if it reports more than INT_MAX zones. This prevents the device from being accepted with inconsistent zone bookkeeping.