CVE-2026-98635: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-98635 Overview

CVE-2026-98635 is an out-of-bounds write vulnerability in the Linux kernel block layer, specifically in the SCSI zoned block device handling code. The flaw resides in blk_revalidate_disk_zones(), which sizes the zones_cond array from disk capacity and zone size. The index used by blk_revalidate_zone_cond() originates from the device-driven report_zones() walk and is never validated against the array size. A storage device reporting more zones than the array can hold causes blk_zone_set_cond() to write beyond the allocated buffer.

Critical Impact
A malicious or malfunctioning zoned block device can trigger a kernel heap out-of-bounds write, leading to memory corruption, kernel panic, or potential privilege escalation.

Affected Products

Linux kernel block layer (SCSI zoned block device subsystem)
Systems using Zoned Block Device (ZBD) or Zoned Namespace (ZNS) storage
Kernel versions prior to the fixing commits 7c431d61b69a and ca688bb20795

Discovery Timeline

2026-10-18 - CVE-2026-98635 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98635

Vulnerability Analysis

The vulnerability stems from a missing bounds check in the block layer zone revalidation path. blk_revalidate_disk_zones() allocates the zones_cond array based on disk capacity divided by zone size. However, the kernel then iterates through zones using an index supplied by the device driver's report_zones() callback. The kernel trusts this index without comparing it to the allocated array size.

When a device reports more zones than fit the array, blk_zone_set_cond() writes zone condition data past the end of the heap allocation. This creates a classic out-of-bounds write primitive in kernel memory.

Root Cause

Two related issues produce the mismatch between array capacity and iteration count. First, both blk_revalidate_zone_args.nr_zones and struct zoned_disk_info.nr_zones are declared as unsigned int. A disk advertising more than UINT_MAX zones (for example, 2^32 + 1024 zones at 512-byte logical block size) truncates the zone count to a small value. The array sized from this truncated value is undersized, while the report walk continues counting upward beyond 32 bits.

Second, no runtime check compares the per-zone index against the nr_zones bound before writing. The fix adds that index check and refuses to revalidate when the total zone count does not fit in 32 bits.

Attack Vector

Exploitation requires a zoned block device that reports a crafted or anomalous zone count. This can occur through a malicious USB-attached SCSI (UAS) device, a compromised storage controller firmware, a virtualized block device under attacker control, or a hardware fault. The attacker needs the ability to attach storage hardware or control the backing storage of a virtual machine. Successful exploitation corrupts adjacent kernel heap data and can escalate to arbitrary kernel memory writes depending on heap layout.

See the upstream patches at kernel.org commit 7c431d61b69a and kernel.org commit ca688bb20795 for the complete patch content.

Detection Methods for CVE-2026-98635

Indicators of Compromise

Kernel oops or panic messages referencing blk_revalidate_disk_zones, blk_revalidate_zone_cond, or blk_zone_set_cond
KASAN slab-out-of-bounds reports pointing at the zones_cond allocation
Unexpected block device revalidation failures logged during device attach or rescan
Attachment of zoned block devices reporting implausibly large zone counts

Detection Strategies

Monitor dmesg and /var/log/kern.log for block layer warnings during ZBD or ZNS device enumeration
Enable KASAN on test and canary systems to catch the out-of-bounds write before production exposure
Audit kernel versions across the fleet to identify hosts missing the fixing commits

Monitoring Recommendations

Alert on unusual block device hot-plug events, particularly SCSI and NVMe zoned namespaces
Track kernel crash telemetry centrally and correlate panics with recent storage device attachments
Review hypervisor logs on virtualization hosts for guests presenting zoned virtual disks with abnormal geometry

How to Mitigate CVE-2026-98635

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in commits 7c431d61b69a3fd0784c20aa4cd0b8fb501b5653 and ca688bb207957cffa5a8cad207329b0dcac1f2c0
Update to a distribution kernel package that includes the fix once released by your vendor
Restrict physical and virtual attachment of untrusted zoned block devices to production systems

Patch Information

The fix adds a bounds check comparing the zone index against the array size before writing the zone condition. It also refuses to revalidate devices whose reported zone count does not fit in 32 bits. Patches are available in the stable kernel tree at commit 7c431d61b69a and commit ca688bb20795.

Workarounds

Disable or blacklist zoned block device drivers on systems that do not require ZBD or ZNS storage
Enforce udev rules that prevent automatic revalidation of newly attached SCSI zoned devices from untrusted buses such as USB
On virtualization platforms, avoid exposing zoned virtual disks to untrusted guests until the host kernel is patched

bash

# Verify running kernel version and check for presence of zoned block devices
uname -r
lsblk -o NAME,ZONED
# Blacklist a specific driver as a temporary workaround (example)
echo "blacklist sd_mod" | sudo tee /etc/modprobe.d/zbd-mitigation.conf