Riskcovery

CVE-2026-98727

nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known

State
Published
Severity
Not scored
Published
Oct 18, 2026
Updated
Oct 19, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known

The namespace head is marked zoned at allocation time based only on the command set identifier. If the zone info query reports a zero zone size, the path namespace is registered without zoned limits while the head still advertises the zoned capability with a zone size of zero, and reporting zones or writing to the head then shifts by ilog2(0).

Drop the zoned feature from the head allocation and let the head limits refresh stack it in from the path namespace instead.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 28982ad73d6a9605708631dc49a0c763cc398aa2 to before 44dc998c38fb5e153c3ed5665f1112661841c3f5Affected
  • 28982ad73d6a9605708631dc49a0c763cc398aa2 to before 2d86abd28071481a1abd87204a47325975dc821cAffected
  • 28982ad73d6a9605708631dc49a0c763cc398aa2 to before 8b85838c1fdba5ba90152693ca158aa9660c628fAffected
  • 28982ad73d6a9605708631dc49a0c763cc398aa2 to before 4a5e49ba0abb8b4328d6318c9aef0c0121f95507Affected
LinuxLinux
  • 6.11Affected
  • before 6.11Not affected
  • 6.12.113 through 6.12.*Not affected
  • 6.18.56 through 6.18.*Not affected
  • 7.2.10 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.