In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known The… (CVE-2026-98727)

The Linux kernel vulnerability CVE-2026-98727 involves the nvme-multipath feature where the BLK_FEAT_ZONED flag was set prematurely at namespace head allocation based solely on the command set identifier. If a zone info query returned a zero zone size, the path namespace was registered without zoned limits, but the head still advertised zoned capability with a zero zone size. This discrepancy caused operations involving zones or writes to perform invalid shifts by ilog2(0). The fix involved dropping the zoned feature flag at head allocation and updating it later based on accurate path namespace zone information.

The vulnerability could cause incorrect behavior in zone reporting and write operations on NVMe multipath devices when the zone size is zero, potentially leading to kernel errors or instability. There is no indication of remote code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to address this issue by deferring the setting of the BLK_FEAT_ZONED flag until accurate zone information is available. Users should apply the official kernel update that includes this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisory for the current remediation guidance.