CVE-2026-98634 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
scsi: sd_zbc: Reject disks with too many zones
sd_zbc_read_zones() computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nr_zones field of struct zoned_disk_info, silently truncating counts that exceed 32 bits. The truncated count is later used to size per-zone resources, while the device may still report more zones than fit.
Moreover, sd_zbc_report_zones() counts the reported zones with a signed int zone_idx, which overflows past INT_MAX. Reject devices reporting more than INT_MAX zones at scan time; such a device is not realistic for any medium that exists today, and accepting it produces inconsistent zone bookkeeping.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel SCSI disk driver contains a critical integer overflow vulnerability within the zoned block device handling logic, specifically in the sd_zbc_read_zones function. This flaw arises from an improper type conversion during the calculation of the total number of zones on a storage device. The internal computation utilizes 64-bit arithmetic to determine the zone count accurately; however, this result is subsequently stored in the nr_zones field of the struct zoned_disk_info structure, which is defined as an unsigned integer with only 32 bits of capacity. When a device reports a number of zones that exceeds the maximum value representable by a 32-bit unsigned integer, the higher-order bits are silently discarded during this assignment operation. This silent truncation results in a significantly smaller and incorrect zone count being retained within the kernel's internal data structures compared to what the hardware actually presents.
The operational impact of this vulnerability is severe due to how the truncated value is subsequently utilized by the storage subsystem. The nr_zones field serves as the primary determinant for sizing per-zone resources, including memory allocations for zone state tracking and other bookkeeping arrays. Because the kernel believes there are far fewer zones than physically exist on the device, it allocates insufficient memory buffers to manage these zones. When the system attempts to access or manipulate data associated with the actual physical zones that fall outside the truncated range, it triggers out-of-bounds memory accesses. This can lead to buffer overflows, heap corruption, and ultimately kernel panics or arbitrary code execution if an attacker can influence the state of the affected storage device through specific I/O patterns.
A secondary but related issue exists within the sd_zbc_report_zones function, which employs a signed integer variable named zone_idx to count reported zones. This counter is susceptible to overflow when it surpasses INT_MAX, leading to inconsistent zone bookkeeping and potential logic errors in subsequent operations that rely on this index for boundary checks or array indexing. The combination of these two flaws creates a scenario where the kernel's view of the device geometry diverges drastically from reality, undermining data integrity and system stability. Such inconsistencies can cause I/O requests to be directed to incorrect locations or processed with invalid parameters, potentially resulting in data loss or corruption on the affected storage medium.
To mitigate this vulnerability, it is essential to reject devices that report an excessive number of zones during the initial scan phase. The kernel developers have addressed this by implementing a check that rejects any device reporting more than INT_MAX zones at scan time. This threshold was chosen because no realistic physical medium currently exists or is foreseeable in the near future that would contain such an astronomical number of zones, making it a safe and practical upper bound for validation. By enforcing this limit early in the initialization process, the kernel prevents the allocation of insufficient resources and avoids entering states where zone bookkeeping becomes inconsistent. This fix ensures that only devices with manageable geometry are accepted into the system, thereby preserving memory safety and operational reliability.
From a vulnerability classification perspective, this issue aligns with CWE-190 Integer Overflow or Wraparound, as it involves arithmetic operations producing results too large for the destination data type without proper validation. Additionally, the exploitation potential relates to CWE-787 Out-of-bounds Write if an attacker can trigger access beyond the allocated buffer limits caused by the truncated zone count. In terms of attack vectors and tactics, this vulnerability may be leveraged within the context of ATT&CK technique T1053 Scheduled Task/Job or more broadly in privilege escalation scenarios where local users might exploit kernel memory corruption to gain elevated privileges. The remediation strategy emphasizes input validation at the boundary between hardware-reported parameters and internal software structures, a fundamental principle for preventing integer-related vulnerabilities in system-level code.