nvme: skip the zoned limits update if the zone info query failed

Description

In the Linux kernel, the following vulnerability has been resolved: nvme: skip the zoned limits update if the zone info query failed nvme_query_zone_info() returns either a negative errno or a positive NVMe status code, but nvme_update_ns_info_block() only tests for the negative case: ret = nvme_query_zone_info(ns, lbaf, &zi); if (ret < 0) goto out; If the device fails the Identify Namespace (I/O Command Set specific) command, or the Identify Controller command issued by nvme_set_max_append(), the positive status falls through and setup continues with the zero-initialized zone info. nvme_update_zone_info() then marks the queue zoned with chunk_sectors and ns->head->zsze set to zero. blk_validate_zoned_limits() does not check chunk_sectors, so the limits commit succeeds. blk_revalidate_disk_zones() does reject the zero zone size, but by then the limits are live and nothing rolls them back, so I/O keeps being submitted to a zoned queue with a zero zone size and disk_zone_no() shifts by ilog2(0): nvme0n1: Invalid non power of two zone size (0) UBSAN: shift-out-of-bounds in include/linux/blkdev.h:747:16 shift exponent -1 is negative disk_zone_no include/linux/blkdev.h:747 [inline] bio_straddles_zones include/linux/blkdev.h:1058 [inline] blk_zone_wplug_handle_write block/blk-zoned.c:1423 [inline] blk_zone_plug_bio.cold+0x25/0x1c8 block/blk-zoned.c:1605 blk_mq_submit_bio+0x18fb/0x2870 block/blk-mq.c:3196 submit_bh_wbc+0x575/0x740 fs/buffer.c:2824 __block_write_full_folio+0x728/0xdd0 fs/buffer.c:1933 Any device, firmware or NVMe-oF target that fails this one command reaches this. Skip the zoned limits update in that case, and log which of the two things happened: during a revalidation the queue keeps the zone geometry it was last validated with, and on a first scan the namespace is registered without zoned limits, so that it is still available as a handle for admin commands. Neither of the paths in nvme_query_zone_info() that return a positive status logs anything, so the failure would otherwise be silent. zi.zone_size is an exact indicator: every path that returns a positive status returns before it is assigned, and after that the only failure left is -ENODEV, which the caller already handles. Found by FuzzNvme.

Timeline

Scores

EPSS (exploitation in 30 days)

0.61% · top 50% of all CVEs (10 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Affected products

• Linux · Linux

  • affected c85c9ab926a592e2f59f7d9a6ca7d6562843d8fa – < a75258e651d91ec25424cd94d824d192c11ccc24
  • affected c85c9ab926a592e2f59f7d9a6ca7d6562843d8fa – < 7fad53ae2052a2b4fc7ca567d6555bdb1176ba35
  • affected c85c9ab926a592e2f59f7d9a6ca7d6562843d8fa – < bb6dafa79040357cf5043836e1db108c2af8b1e1
  • affected c85c9ab926a592e2f59f7d9a6ca7d6562843d8fa – < 3838e80fcfb32e62baffb63c6dc0a60153665a4d

• Linux · Linux

  • affected 6.9
  • unaffected < 6.9
  • unaffected 6.12.112 – ≤ 6.12.*
  • unaffected 6.18.52 – ≤ 6.18.*
  • unaffected 7.2.5 – ≤ 7.2.*
  • unaffected 7.3 – ≤ *

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-80571 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-89971](https://cveledger.app/badge/CVE-2026-89971.svg)](https://cveledger.app/cve/CVE-2026-89971)

Record last updated 19 Oct 2026, 08:55 UTC.