CVE-2026-98635
Description
A flaw was found in the Linux kernel. An attacker who attaches a specially crafted storage device can cause a Denial of Service (DoS) or kernel memory corruption. When the kernel revalidates zoned block devices—storage media divided into independent physical regions—it fails to verify that the reported zone index fits within the allocated memory buffer. This issue triggers an out-of-bounds write operation, leading to system instability or a kernel crash.
Statement
Red Hat has evaluated this vulnerability as a Moderate severity impact because successful exploitation requires connecting a malicious or specially manipulated zoned block device, which demands physical presence or the ability to attach virtualized storage hardware. While the improper boundary validation during device inspection can induce kernel memory corruption and cause an immediate system crash, it cannot be triggered across the network without existing storage attachment capabilities. In typical Red Hat deployments, zoned storage architectures are rarely exposed to untrusted external media, significantly restricting potential attack vectors.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.2 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
