In the Linux kernel, the following vulnerability has been resolved: scsi: block: Fix zones_cond out-of-bounds write on zone report… (CVE-2026-98635)

The vulnerability in the Linux kernel's SCSI block layer involved the function blk_revalidate_disk_zones() sizing the zones_cond array based on disk capacity and zone size, but the index used by blk_revalidate_zone_cond() was derived from the device's report_zones() walk without bounds checking. If a device reported more zones than the array could hold, especially when the zone count exceeded UINT_MAX (32-bit unsigned int), the zone count was truncated, leading to an undersized array and out-of-bounds writes by blk_zone_set_cond(). The fix involved checking the index against the array size before writing and refusing to revalidate if the zone count exceeds 32 bits.

This vulnerability could lead to out-of-bounds memory writes in the kernel, potentially causing memory corruption, system instability, or crashes. However, exploitation requires a device reporting an abnormally large number of zones exceeding 32 bits, which is an unusual scenario. There are no known exploits in the wild.

A fix has been implemented in the Linux kernel to check zone indices against the array size and to refuse revalidation when the zone count exceeds 32 bits. Users should update to a kernel version that includes this fix once available. Patch status is not yet confirmed from vendor advisory; check the official Linux kernel advisories for the current remediation guidance.