The Linux kernel memstick driver had a vulnerability where msb_ftl_initialize() computed the zone count from the card's block count without bounds checking. Since msb->block_count is derived from the card's reported number of blocks, a card reporting more than MS_MAX_ZONES * MS_BLOCKS_IN_ZONE blocks (where MS_MAX_ZONES is 16) could cause the driver to write past the bounds of the free_block_count array, corrupting the msb_data structure. The fix involves rejecting cards that report more blocks than the maximum supported, preventing out-of-bounds memory writes.

This vulnerability could lead to memory corruption within the kernel's memstick driver data structures, potentially causing system instability or crashes. There is no information about exploitation in the wild or further impact such as privilege escalation.

A fix has been implemented in the Linux kernel memstick driver to reject Memory Stick cards that report more blocks than the supported maximum. Users should apply the official kernel updates that include this fix. Patch status is not explicitly stated in the provided data; check the vendor advisory or Linux kernel release notes for the exact fixed versions and update accordingly.