Linux NVMe host: a positive Identify status is ignored and a zoned queue is set up with zero zone size

Impact

nvme_update_ns_info_block() only tests for a negative return from nvme_query_zone_info(), so a positive NVMe status from Identify falls through and the namespace is registered as zoned with a zero zone size. Live limits then drive a shift by ilog2(0) on the I/O submission path. Any device, firmware or NVMe-oF target that fails that one command reaches it, which puts the trigger on the storage side rather than the host side - a misbehaving or hostile NVMe-oF target can push a GPU node into this state. The record describes a crash path only; no privilege gain is claimed.

Who can reach it

A local NVMe device or a remote NVMe-oF target that fails the Identify command during namespace scan or revalidation. No host-side authentication is involved; the host is the victim of what the target answers.

What to do

Pick up the stable kernel with the fix (it skips the zoned limits update and logs the failure) and reboot the node. No fixed version numbers are given in the record, only the three stable commits.

References

Related entries

• Linux nvme-fc: double free of fabrics options when nvme_add_ctrl() fails during connectCVE-2026-89974 · Linux kernel nvme-fc (fabrics options ownership on controller init failure)High
• Linux kernel (overlayfs, Ubuntu patch): OverlayFS file-capability privilege escalationCVE-2021-3493 · Linux kernel (overlayfs, Ubuntu patch)High
• OpenSSL: X.400 address type confusion in X.509 GeneralNameCVE-2023-0286 · OpenSSLHigh
• Linux kernel (net/sched tcindex): Use-after-free in the tcindex traffic-control filter - local rootCVE-2023-1829 · Linux kernel (net/sched tcindex)High
• QEMU: missing iov bounds check in the virtio-snd input callback gives a guest a heap out-of-bounds writeCVE-2026-3195 · QEMU virtio-snd device (virtio_snd_pcm_in_cb input callback)High
• Linux kernel (arch/x86/kvm/svm): After a CPU offline/online cycle, KVM's ASID generation counter is reset in a way thatCVE-2026-68093 · Linux kernel (arch/x86/kvm/svm)High