Strix
72.9K

CVE-2026-98727

Unknown

Last modified

CVE-2026-98727 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known The namespace head is marked zoned at allocation time based only on the command set identifier. If the zone info query reports a zero zone size, the path namespace is registered without zoned limits while the head still advertises the zoned capability with a zone size of zero, and reporting zones or writing to the head then shifts by ilog2(0). Drop the zoned feature from the head allocation and let the head limits refresh stack it in from the path namespace instead..

Description

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known The namespace head is marked zoned at allocation time based only on the command set identifier. If the zone info query reports a zero zone size, the path namespace is registered without zoned limits while the head still advertises the zoned capability with a zone size of zero, and reporting zones or writing to the head then shifts by ilog2(0). Drop the zoned feature from the head allocation and let the head limits refresh stack it in from the path namespace instead.

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 28982ad73d6a9605708631dc49a0c763cc398aa2, < 44dc998c38fb5e153c3ed5665f1112661841c3f5; >= 28982ad73d6a9605708631dc49a0c763cc398aa2, < 2d86abd28071481a1abd87204a47325975dc821c; >= 28982ad73d6a9605708631dc49a0c763cc398aa2, < 8b85838c1fdba5ba90152693ca158aa9660c628f; >= 28982ad73d6a9605708631dc49a0c763cc398aa2, < 4a5e49ba0abb8b4328d6318c9aef0c0121f95507
LinuxLinux6.11

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-98727?
In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known The namespace head is marked zoned at allocation time based only on the command set identifier. If the zone info query reports a zero zone size, the path namespace is registered without zoned limits while the head still advertises the zoned capability with a zone size of zero, and reporting zones or writing to the head then shifts by ilog2(0). Drop the zoned feature from the head allocation and let the head limits refresh stack it in from the path namespace instead.
How severe is CVE-2026-98727?
Severity scoring for CVE-2026-98727 is pending analysis.
How do I fix CVE-2026-98727?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-98727?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST