UBUNTU-CVE-2026-98635: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: scsi: block: Fix zonescond out-of-bounds write on zone report blkrevalidatediskzones() sizes the zonescond array from the disk capacity and zone size, but the index used by blkrevalidatezonecond() comes from the device-driven reportzones() walk and is never checked against the array size. A device reporting more zones than fit the array makes blkzonesetcond() write out of bounds. One way to reach this is a zone count exceeding 32 bits: both blkrevalidatezoneargs.nrzones and struct zoneddiskinfo.nrzones are unsigned int, so a disk advertising more than UINTMAX zones (e.g. 2^32 + 1024 zones of one 512-byte logical block) gets its zone count truncated to a small value, undersizing the array while the report walk keeps counting upward. Check the index against the array size before storing the zone condition, and refuse to revalidate when the zone count does not fit 32 bits.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the Linux kernel SCSI block zone revalidation code, check the zone-report index against the zones_cond array size before storing the zone condition, and refuse to revalidate when the reported zone count does not fit in 32 bits.
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
Systems using an affected listed Ubuntu kernel and revalidating a zoned block device are exposed. The triggering condition described is a device that reports more zones than fit in a 32-bit unsigned integer, such as more than 2^32 zones with 512-byte logical blocks.
What does an attacker or malicious device need to do to trigger the flaw?
The device must provide zone-report data that causes the report_zones() walk to enumerate more zones than the kernel-sized zones_cond array can hold. This can occur when the advertised zone count exceeds UINT_MAX and is truncated while the report walk continues indexing upward.
Does the issue require user interaction or prior privileges?
The provided severity vector indicates no user interaction and no privileges are required. The described trigger nevertheless depends on processing zone reports from a device with the malformed or oversized zone configuration.
What behavior indicates the system may be affected during zone revalidation?
Affected systems can perform an out-of-bounds write when storing a reported zone condition during disk zone revalidation. The vulnerable path is blk_revalidate_disk_zones(), specifically the zone-condition update reached through blk_revalidate_zone_cond().
What is the mitigation when patching cannot be applied immediately?
The provided data supports avoiding revalidation of zoned devices that report a zone count exceeding 32-bit range. The resolved behavior is to reject revalidation when the zone count does not fit in 32 bits and to check the reported-zone index before storing its condition.