CVE-2026-68478: memstick: ms_block: reject a card that reports too many blocks
In the Linux kernel, the following vulnerability has been resolved:
memstick: msblock: reject a card that reports too many blocks
msbftlinitialize() computes the zone count from the card block count with no bound:
msb->zonecount = msb->blockcount / MSBLOCKSINZONE; ... for (i = 0; i < msb->zonecount; i++) msb->freeblockcount[i] = MSBLOCKSINZONE;
msb->blockcount is a card value. msbreadbootblocks() reads numberofblocks from the card boot page and byte swaps it. freeblockcount is a fixed int[MSMAXZONES]. MSMAXZONES is 16, so the valid indices are 0 to 15. The init loop above indexes it by zonecount. msbmarkblockused() and msbmarkblockunused() index it by pba / MSBLOCKSINZONE, for pba up to blockcount - 1. A card may report up to 65535 blocks. A blockcount above 8192 (MSMAXZONES MSBLOCKSINZONE) lets the pba index reach 16. That writes past freeblockcount[] and corrupts struct msbdata. A larger count runs the init loop past the end too.
A real Memory Stick has at most 16 zones. So it has at most 8192 blocks. msbftlinitialize() now rejects a card that reports more than MSMAXZONES MSBLOCKSINZONE blocks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the Linux kernel’s memstick ms_block logic to reject a Memory Stick card that reports more than MS_MAX_ZONES * MS_BLOCKS_IN_ZONE blocks; ensure the initialization rejects such cards so msb_ftl_initialize() does not compute zone_count beyond the valid indices 0 to 15 for free_block_count[MS_MAX_ZONES].
Linux kernel memstick (memstick: ms_block) Card block count / zone-count bounds = Reject cards reporting too many blocks (pba-derived zone_count must be within 0..15)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68478?
The severity of CVE-2026-68478 is rated as 34.
What is CVE-2026-68478 about?
CVE-2026-68478 addresses a vulnerability in the Linux kernel related to memstick that allows a card reporting too many blocks to be incorrectly processed.
How do I fix CVE-2026-68478?
To fix CVE-2026-68478, ensure that you apply the latest security patches or updates for the Linux kernel.
What systems are affected by CVE-2026-68478?
CVE-2026-68478 affects systems running vulnerable versions of the Linux kernel with the memstick driver.
Is CVE-2026-68478 exploited in the wild?
As of now, there are no reports indicating that CVE-2026-68478 is being actively exploited in the wild.