CVE-2026-98634

In the Linux kernel, the following vulnerability has been resolved:

scsi: sd zbc: Reject disks with too many zones

sd zbc read zones() computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nr zones field of struct zoned disk info, silently truncating counts that exceed 32 bits. The truncated count is later used to size per-zone resources, while the device may still report more zones than fit.

Moreover, sd zbc report zones() counts the reported zones with a signed int zone idx, which overflows past INT MAX. Reject devices reporting more than INT MAX zones at scan time; such a device is not realistic for any medium that exists today, and accepting it produces inconsistent zone bookkeeping.