VulnerabilityPublished 18 Oct 2026

CVE-2026-98634: Linux kernel · scsi: sd_zbc: Reject disks with too many zones

Source GCVE Database

Authoritative record:CVE-2026-98634· Low

Not known to be exploited · fixed in d8791ae55d85dfaeafa20ea48365482a0cc5a107 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 17:16 UTC

Severity

Low

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in d8791ae55d85dfaeafa20ea48365482a0cc5a107, b6ec0f79745967c751c85df373062c8d15e45fc4, 3ddf8383b54456f19fd73d3cebed81bd250c7388 +1

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-gc5v-q6x9-gww4

What to do

Upgrade Linux kernel to d8791ae55d85dfaeafa20ea48365482a0cc5a107, b6ec0f79745967c751c85df373062c8d15e45fc4, 3ddf8383b54456f19fd73d3cebed81bd250c7388 or 0af16d8be3ec7ff28bb56a0da79c9aed66ac2c3b.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 89d9475610771b5e5fe1879075f0fc9ba6e3755f, < d8791ae55d85dfaeafa20ea48365482a0cc5a107	Fixed in d8791ae55d85dfaeafa20ea48365482a0cc5a107
LinuxLinux	Affected ≥ 89d9475610771b5e5fe1879075f0fc9ba6e3755f, < b6ec0f79745967c751c85df373062c8d15e45fc4	Fixed in b6ec0f79745967c751c85df373062c8d15e45fc4
LinuxLinux	Affected ≥ 89d9475610771b5e5fe1879075f0fc9ba6e3755f, < 3ddf8383b54456f19fd73d3cebed81bd250c7388	Fixed in 3ddf8383b54456f19fd73d3cebed81bd250c7388
LinuxLinux	Affected ≥ 89d9475610771b5e5fe1879075f0fc9ba6e3755f, < 0af16d8be3ec7ff28bb56a0da79c9aed66ac2c3b	Fixed in 0af16d8be3ec7ff28bb56a0da79c9aed66ac2c3b
LinuxLinux	Affected =4.10	Fixed in–

AI-suggested

The vulnerability has been resolved by rejecting devices that report more than INT_MAX zones at scan time. No further action is required for realistic devices. Users should ensure their Linux kernel is updated to a version containing this fix to prevent inconsistent zone bookkeeping with malformed or unrealistic devices.

Description

A vulnerability in the Linux kernel's SCSI subsystem (sd_zbc) was resolved that involved improper handling of disks reporting an excessively large number of zones. The function sd_zbc_read_zones() used 64-bit arithmetic but stored the result in a 32-bit unsigned integer, causing silent truncation of zone counts exceeding 32 bits. Additionally, sd_zbc_report_zones() used a signed integer to count zones, which could overflow if the device reported more than INT_MAX zones. The fix rejects devices reporting more than INT_MAX zones at scan time, as such devices are unrealistic and cause inconsistent zone bookkeeping.

Impact

Devices reporting an excessively large number of zones can cause silent truncation and integer overflow in zone counting, leading to inconsistent zone bookkeeping within the kernel. This could potentially cause incorrect resource allocation or kernel misbehavior when handling such devices. However, devices with more than INT_MAX zones are not realistic for current storage media, limiting practical impact.

References

Community reviews

Loading reviews…