CVE-2026-98727 (GCVE-0-2026-98727)
Vulnerability from cvelistv5
Published
2026-10-18 15:47
Modified
2026-10-19 09:24
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known The namespace head is marked zoned at allocation time based only on the command set identifier. If the zone info query reports a zero zone size, the path namespace is registered without zoned limits while the head still advertises the zoned capability with a zone size of zero, and reporting zones or writing to the head then shifts by ilog2(0). Drop the zoned feature from the head allocation and let the head limits refresh stack it in from the path namespace instead.
References
Impacted products
Vendor Product Version
Linux Linux Version: 28982ad73d6a9605708631dc49a0c763cc398aa2
Version: 28982ad73d6a9605708631dc49a0c763cc398aa2
Version: 28982ad73d6a9605708631dc49a0c763cc398aa2
Version: 28982ad73d6a9605708631dc49a0c763cc398aa2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/host/multipath.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "44dc998c38fb5e153c3ed5665f1112661841c3f5",
              "status": "affected",
              "version": "28982ad73d6a9605708631dc49a0c763cc398aa2",
              "versionType": "git"
            },
            {
              "lessThan": "2d86abd28071481a1abd87204a47325975dc821c",
              "status": "affected",
              "version": "28982ad73d6a9605708631dc49a0c763cc398aa2",
              "versionType": "git"
            },
            {
              "lessThan": "8b85838c1fdba5ba90152693ca158aa9660c628f",
              "status": "affected",
              "version": "28982ad73d6a9605708631dc49a0c763cc398aa2",
              "versionType": "git"
            },
            {
              "lessThan": "4a5e49ba0abb8b4328d6318c9aef0c0121f95507",
              "status": "affected",
              "version": "28982ad73d6a9605708631dc49a0c763cc398aa2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/host/multipath.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.56",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.113",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.56",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.10",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-multipath: set BLK_FEAT_ZONED only after the zone info is known\n\nThe namespace head is marked zoned at allocation time based only on the\ncommand set identifier.  If the zone info query reports a zero zone size,\nthe path namespace is registered without zoned limits while the head\nstill advertises the zoned capability with a zone size of zero, and\nreporting zones or writing to the head then shifts by ilog2(0).\n\nDrop the zoned feature from the head allocation and let the head limits\nrefresh stack it in from the path namespace instead."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:24:37.897Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/44dc998c38fb5e153c3ed5665f1112661841c3f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d86abd28071481a1abd87204a47325975dc821c"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b85838c1fdba5ba90152693ca158aa9660c628f"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a5e49ba0abb8b4328d6318c9aef0c0121f95507"
        }
      ],
      "title": "nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98727",
    "datePublished": "2026-10-18T15:47:04.645Z",
    "dateReserved": "2026-09-25T10:25:14.366Z",
    "dateUpdated": "2026-10-19T09:24:37.897Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.