An out‑of‑bounds write to the zone condition array in the Linux kernel’s SCSI block driver can corrupt kernel memory. The flaw occurs when a storage device reports more zones than the 32‑bit counter can hold, causing the kernel to allocate a smaller array than needed. Subsequent processing writes past the array boundary, which can lead to arbitrary kernel code execution or a system crash if an attacker supplies a malicious device.

All Linux kernel builds that contain the SCSI block driver, including recent stable releases, may be affected. The vulnerability is tied to the blk_revalidate_disk_zones path; any kernel image using this code is potentially impacted.

The CVSS score is not provided and the EPSS data is unavailable, but the bug was fixed in a kernel release, indicating its severity. Exploitation would require a privileged process to communicate with a specially crafted block device that reports an oversized zone count. No public exploits are known, and it is not listed in CISA’s KEV, suggesting a moderate to low likelihood of exploitation in the wild. Nonetheless, memory corruption in kernel space is a high‑risk condition, warranting timely patching.