The flaw lies in the f_mass_storage driver, where the function check_command_size_in_blocks() shifts a size value by the block size without checking for overflow. If a host issues a SCSI READ or WRITE command that requests a large data size, the shift can wrap, producing a truncated value. This bypasses buffer boundary checks and can lead to memory corruption or out‑of‑bounds accesses inside the kernel. The weakness corresponds to an unchecked shift operator vulnerability. This overflow is a classic integer overflow issue (CWE-190).\n

Affected are all Linux kernel builds that include the f_mass_storage gadget driver and have not applied the patch referred to in the commit logs. No specific kernel version range is listed, so any kernel with the default f_mass_storage implementation is potentially vulnerable.\n

According to the available metrics, the EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating low current exploitation probability. However, a malicious USB host controlling SCSI commands could trigger the overflow. The attack requires physical or remote access to a USB host that can exchange SCSI commands with the device, and exploitation would likely result in kernel memory corruption, potentially escalating privileges or causing a crash. The CVSS score of 5.5 indicates a moderate level of severity.