In the Linux kernel, the following vulnerability has been resolved: scsi: sd_zbc: Reject disks with too many zones sd_zbc_read_zones() computes the… (CVE-2026-98634)

The vulnerability in the Linux kernel's scsi: sd_zbc component arises from integer truncation and overflow issues when handling disks with a very large number of zones. Specifically, sd_zbc_read_zones() computes the number of zones using 64-bit arithmetic but stores the count in a 32-bit unsigned int, truncating values that exceed 32 bits. This truncated count is then used to allocate per-zone resources, which can lead to inconsistencies if the actual number of zones is larger. Furthermore, sd_zbc_report_zones() uses a signed int to count zones, which overflows if the zone count exceeds INT_MAX. The vulnerability is mitigated by rejecting devices that report more than INT_MAX zones during scanning, preventing inconsistent zone bookkeeping. This issue affects the Linux kernel's SCSI zoned block device handling and has been resolved by rejecting unrealistic devices at scan time.

Devices reporting an excessively large number of zones can cause silent truncation and integer overflow in zone counting, leading to inconsistent zone bookkeeping within the kernel. This could potentially cause incorrect resource allocation or kernel misbehavior when handling such devices. However, devices with more than INT_MAX zones are not realistic for current storage media, limiting practical impact.

The vulnerability has been resolved by rejecting devices that report more than INT_MAX zones at scan time. No further action is required for realistic devices. Users should ensure their Linux kernel is updated to a version containing this fix to prevent inconsistent zone bookkeeping with malformed or unrealistic devices.