CVE-2026-98635

A flaw was found in the Linux kernel. An attacker who attaches a specially crafted storage device can cause a Denial of Service (DoS) or kernel memory corruption. When the kernel revalidates zoned block devices—storage media divided into independent physical regions—it fails to verify that the reported zone index fits within the allocated memory buffer. This issue triggers an out-of-bounds write operation, leading to system instability or a kernel crash.

Red Hat has evaluated this vulnerability as a Moderate severity impact because successful exploitation requires connecting a malicious or specially manipulated zoned block device, which demands physical presence or the ability to attach virtualized storage hardware. While the improper boundary validation during device inspection can induce kernel memory corruption and cause an immediate system crash, it cannot be triggered across the network without existing storage attachment capabilities. In typical Red Hat deployments, zoned storage architectures are rarely exposed to untrusted external media, significantly restricting potential attack vectors.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.