CVE-2026-98727None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known The namespace head is marked zoned at allocation time based only on the command set identifier. I…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
In the Linux kernel, the following vulnerability has been resolved:
nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known
The namespace head is marked zoned at allocation time based only on the command set identifier. If the zone info query reports a zero zone size, the path namespace is registered without zoned limits while the head still advertises the zoned capability with a zone size of zero, and reporting zones or writing to the head then shifts by ilog2(0).
Drop the zoned feature from the head allocation and let the head limits refresh stack it in from the path namespace instead.
Linux >= 28982ad73d6a9605708631dc49a0c763cc398aa2 < 44dc998c38fb5e153c3ed5665f1112661841c3f5Linux >= 28982ad73d6a9605708631dc49a0c763cc398aa2 < 2d86abd28071481a1abd87204a47325975dc821cLinux >= 28982ad73d6a9605708631dc49a0c763cc398aa2 < 8b85838c1fdba5ba90152693ca158aa9660c628fLinux >= 28982ad73d6a9605708631dc49a0c763cc398aa2 < 4a5e49ba0abb8b4328d6318c9aef0c0121f95507Linux 6.11Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-98770Noneusb: gadget: midi2: Fix the jack descriptor array sizes
CVE-2026-98769Noneusb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
CVE-2026-98774Nonerust_binder: cancel deferred work items in thread exit
CVE-2026-98772NoneUSB: serial: fix port tear down use-after-free
CVE-2026-98771Noneusb: storage: sierra_ms: reject short SWoC info transfers
CVE-2026-98776Nonebinderfs: fix UAF write in binder_add_device