CVE-2026-68478

A flaw was found in the Linux kernel's Memory Stick block driver (memstick: ms_block). A malicious Memory Stick card, crafted to report an excessive number of blocks, can cause the driver to write beyond the bounds of an allocated memory structure. This out-of-bounds write can lead to memory corruption within the kernel, potentially resulting in a system crash or other unpredictable behavior.

Red Hat rates this vulnerability as having a Moderate severity impact because exploitation is constrained to local physical insertion of a crafted Memory Stick storage device, restricting the primary threat to a denial of service through kernel crashes without remote attack vectors. In typical Red Hat Enterprise Linux configurations, support for this legacy removable media driver is not enabled by default, minimizing exposure across enterprise server and cloud environments. Exploitation requires either direct physical access to connect hardware or administrative privileges to attach emulated devices in virtualized environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.