nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.20 % · percentile 10 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known The namespace head is marked zoned at allocation time based only on the command set identifier. If the zone info query reports a zero zone size, the path namespace is registered without zoned limits while the head still advertises the zoned capability with a zone size of zero, and reporting zones or writing to the head then shifts by ilog2(0). Drop the zoned feature from the head allocation and let the head limits refresh stack it in from the path namespace instead.
References
European references
- ENISA EUVD · EUVD-2026-103812
- GCVE · GCVE-0-2026-98727
CERT-FR advisories
- CERTFR-2026-AVI-1375 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 28982ad73d6a9605708631dc49a0c763cc398aa2 < 44dc998c38fb5e153c3ed5665f1112661841c3f5 ; affected 28982ad73d6a9605708631dc49a0c763cc398aa2 < 2d86abd28071481a1abd87204a47325975dc821c ; affected 28982ad73d6a9605708631dc49a0c763cc398aa2 < 8b85838c1fdba5ba90152693ca158aa9660c628f ; affected 28982ad73d6a9605708631dc49a0c763cc398aa2 < 4a5e49ba0abb8b4328d6318c9aef0c0121f95507 |
| Linux · Linux | affected 6.11 ; unaffected 0 < 6.11 ; unaffected 6.12.113 ≤ 6.12.* ; unaffected 6.18.56 ≤ 6.18.* ; unaffected 7.2.10 ≤ 7.2.* ; unaffected 7.3 ≤ * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |