The vulnerability is introduced by integer truncation and overflow in the Linux kernel’s zoned block device driver (sd_zbc). When a device reports a very large number of zones, the 64‑bit zone count is silently truncated to a 32‑bit field, and the per‑zone resource allocation later uses this shortened value. Additionally, an overflow of a signed 32‑bit zone index counter can occur when a device reports more zones than the maximum value of a signed int. These conditions lead to inconsistent bookkeeping of zones. Based on the description, it is inferred that such inconsistencies could potentially cause failures in resource allocation or driver initialization, which might manifest as a denial of service, but this outcome is not explicitly stated in the CVE details.

All Linux kernel builds that include the sd_zbc driver are potentially affected. No specific kernel version range is listed, so any distribution shipping the standard kernel should be considered vulnerable until a fix is released upstream.

The CVSS and EPSS scores are unavailable and the vulnerability is not listed in CISA's KEV catalog. The device that would trigger the overflow would need to report more zones than any real medium supports today, making practical exploitation highly unlikely. The risk remains theoretical, and no public proof‑of‑concept exploit is documented. The theoretical impact is limited to inconsistent zone handling and, if the overflow causes allocation failures, a possible disruption of services that rely on zoned block devices.