GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GHSA-PPGX-492F-63H6

Vulnerability from github – Published: 2026-08-15 06:32 – Updated: 2026-08-15 06:32
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

memstick: ms_block: reject a card that reports too many blocks

msb_ftl_initialize() computes the zone count from the card block count with no bound:

msb->zone_count = msb->block_count / MS_BLOCKS_IN_ZONE;
...
for (i = 0; i < msb->zone_count; i++)
    msb->free_block_count[i] = MS_BLOCKS_IN_ZONE;

msb->block_count is a card value. msb_read_boot_blocks() reads number_of_blocks from the card boot page and byte swaps it. free_block_count is a fixed int[MS_MAX_ZONES]. MS_MAX_ZONES is 16, so the valid indices are 0 to 15. The init loop above indexes it by zone_count. msb_mark_block_used() and msb_mark_block_unused() index it by pba / MS_BLOCKS_IN_ZONE, for pba up to block_count - 1. A card may report up to 65535 blocks. A block_count above 8192 (MS_MAX_ZONES * MS_BLOCKS_IN_ZONE) lets the pba index reach 16. That writes past free_block_count[] and corrupts struct msb_data. A larger count runs the init loop past the end too.

A real Memory Stick has at most 16 zones. So it has at most 8192 blocks. msb_ftl_initialize() now rejects a card that reports more than MS_MAX_ZONES * MS_BLOCKS_IN_ZONE blocks.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-68478"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-15T06:20:47Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemstick: ms_block: reject a card that reports too many blocks\n\nmsb_ftl_initialize() computes the zone count from the card block count\nwith no bound:\n\n\tmsb-\u003ezone_count = msb-\u003eblock_count / MS_BLOCKS_IN_ZONE;\n\t...\n\tfor (i = 0; i \u003c msb-\u003ezone_count; i++)\n\t\tmsb-\u003efree_block_count[i] = MS_BLOCKS_IN_ZONE;\n\nmsb-\u003eblock_count is a card value. msb_read_boot_blocks() reads\nnumber_of_blocks from the card boot page and byte swaps it.\nfree_block_count is a fixed int[MS_MAX_ZONES]. MS_MAX_ZONES is 16, so the\nvalid indices are 0 to 15. The init loop above indexes it by zone_count.\nmsb_mark_block_used() and msb_mark_block_unused() index it by\npba / MS_BLOCKS_IN_ZONE, for pba up to block_count - 1. A card may report\nup to 65535 blocks. A block_count above 8192 (MS_MAX_ZONES *\nMS_BLOCKS_IN_ZONE) lets the pba index reach 16. That writes past\nfree_block_count[] and corrupts struct msb_data. A larger count runs the\ninit loop past the end too.\n\nA real Memory Stick has at most 16 zones. So it has at most 8192 blocks.\nmsb_ftl_initialize() now rejects a card that reports more than\nMS_MAX_ZONES * MS_BLOCKS_IN_ZONE blocks.",
  "id": "GHSA-ppgx-492f-63h6",
  "modified": "2026-08-15T06:32:08Z",
  "published": "2026-08-15T06:32:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68478"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/39151f0708c84221e94cdd6aa070aba5d7cb1c01"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/47f0c7d856c67c9935546d2644f18c0d0131b449"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/718178f524b98bc920d74bc771aed823c8b81425"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8937b11f1c3896e066c3fb07387ba17bc8c50b8a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a4b9961efe8640f50800811b4a2b2046b3dc2ccc"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b86666ac4009a252501cc17242582a7ec9ed976e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d5db3439ee8d1c165a09a47e984c4ba508c130df"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f1c675ecf6e5ad02722f0019f729d8bb588d502e"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.