The vulnerability CVE-2026-6684 affects ChaN FatFs versions prior to R0.16 when using GPT scanning with the FF_LBA64 configuration set to 1. The issue arises from an unbounded loop count derived from the GPT header field GPTH_PtNum, which causes a loop with an unreachable exit condition (CWE-835). This results in potentially infinite or very long mount-time scans, causing denial of service due to resource exhaustion. The CVSS v3.1 score is 4.6 (medium), with an attack vector requiring physical access (AV:P), low attack complexity, no privileges or user interaction needed, and impact limited to availability. There is no vendor advisory or patch information available at this time.

The primary impact is denial of service due to an infinite or excessively long loop during the mount process when scanning GPT partitions. There is no confidentiality or integrity impact reported. Exploitation requires physical access to the device or media containing the affected FatFs implementation. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using FatFs with FF_LBA64 = 1 on systems where GPT scanning is required, or implement external controls to limit mount-time operations. Monitor vendor channels for updates and apply official patches once released.