A missing bounds check in the Memory Stick block controller permits a Memory Stick card that reports more blocks than expected to cause the driver to write beyond the allocated free block count array. The overflow corrupts the msb_data structure, producing a classic kernel memory corruption vulnerability that could allow an attacker to overwrite kernel data, potentially leading to privilege escalation or system crash.

All Linux kernel releases that ship the ms_block driver without the new commit that rejects excessive block counts are vulnerable. The vulnerability exists until the fix is applied, so any kernel version that includes the Memory Stick support path (CONFIG_MEMSTICK and CONFIG_MS_BLOCK) and has not received the recent patch is at risk.

The EPSS score is < 1% and the vulnerability is not listed in CISA KEV, indicating no known active exploitation at this time. Based on the description, the likely attack vector is local physical insertion of a malicious Memory Stick card. The exploit requires physical access to the target machine and an environment where a Memory Stick card can be inserted. While no public exploits have been documented, the out‑of‑bounds write in kernel space presents a high‑severity risk for affected hosts.