CVE-2026-68478

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

memstick: ms_block: reject a card that reports too many blocks

msb_ftl_initialize() computes the zone count from the card block count

with no bound:

msb->zone_count = msb->block_count / MS_BLOCKS_IN_ZONE;

...

for (i = 0; i < msb->zone_count; i++)

msb->free_block_count[i] = MS_BLOCKS_IN_ZONE;

msb->block_count is a card value. msb_read_boot_blocks() reads

number_of_blocks from the card boot page and byte swaps it.

free_block_count is a fixed int[MS_MAX_ZONES]. MS_MAX_ZONES is 16, so the

valid indices are 0 to 15. The init loop above indexes it by zone_count.

msb_mark_block_used() and msb_mark_block_unused() index it by

pba / MS_BLOCKS_IN_ZONE, for pba up to block_count - 1. A card may report

up to 65535 blocks. A block_count above 8192 (MS_MAX_ZONES *

MS_BLOCKS_IN_ZONE) lets the pba index reach 16. That writes past

free_block_count[] and corrupts struct msb_data. A larger count runs the

init loop past the end to

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References