CVE-2026-68478

Received Received - Intake

Buffer Overflow in Linux Kernel memstick Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: memstick: ms_block: reject a card that reports too many blocks msb_ftl_initialize() computes the zone count from the card block count with no bound: msb->zone_count = msb->block_count / MS_BLOCKS_IN_ZONE; ... for (i = 0; i < msb->zone_count; i++) msb->free_block_count[i] = MS_BLOCKS_IN_ZONE; msb->block_count is a card value. msb_read_boot_blocks() reads number_of_blocks from the card boot page and byte swaps it. free_block_count is a fixed int[MS_MAX_ZONES]. MS_MAX_ZONES is 16, so the valid indices are 0 to 15. The init loop above indexes it by zone_count. msb_mark_block_used() and msb_mark_block_unused() index it by pba / MS_BLOCKS_IN_ZONE, for pba up to block_count - 1. A card may report up to 65535 blocks. A block_count above 8192 (MS_MAX_ZONES * MS_BLOCKS_IN_ZONE) lets the pba index reach 16. That writes past free_block_count[] and corrupts struct msb_data. A larger count runs the init loop past the end too. A real Memory Stick has at most 16 zones. So it has at most 8192 blocks. msb_ftl_initialize() now rejects a card that reports more than MS_MAX_ZONES * MS_BLOCKS_IN_ZONE blocks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-68478

EUVD

EUVD-2026-59100

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves the memstick subsystem improperly handling a Memory Stick card that reports an excessive number of blocks. The flaw occurs when the system calculates zone counts from the card's block count without proper bounds checking, leading to potential memory corruption by writing past the allocated array bounds.

Detection Guidance

This vulnerability affects the Linux kernel's memstick subsystem, specifically the ms_block driver. Detection requires checking for systems using vulnerable kernel versions with Memory Stick card readers. Inspect kernel logs for errors related to ms_block or Memory Stick devices. Commands like 'dmesg | grep ms_block' or 'journalctl -k | grep ms_block' may reveal issues. Ensure your kernel version is patched.

Impact Analysis

An attacker could exploit this to cause a denial of service or execute arbitrary code by inserting a maliciously crafted Memory Stick card. This could crash the system or allow unauthorized access if the kernel memory is corrupted.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a memory corruption issue in the Linux kernel's memstick driver that could lead to system instability or crashes if exploited. Compliance impacts would only occur if the vulnerability were exploited to gain unauthorized access or manipulate data, which is not described here.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve this issue. If immediate patching is not possible, disable the ms_block module using 'modprobe -r ms_block' and blacklist it in '/etc/modprobe.d/'. Avoid inserting untrusted Memory Stick cards until patched. Monitor vendor advisories for kernel updates.

Hi! I’m here to help you understand CVE-2026-68478. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70