{"id":"CVE-2026-99038","kind":"vulnerability","aliases":["CVE-2026-99038"],"related":[],"title":"Linux kernel: memstick driver can hang removal on rtsx_usb cards","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmemstick: rtsx_usb_ms: complete requests after eject instead of dropping them\n\nmemstick_check() can pass its host->removing check just before\nrtsx_usb_ms_drv_remove() sets eject/removing. Its next request is then\nsilently dropped: rtsx_usb_ms_request() skips schedule_work() once eject\nis set, and drv_remove's cancel_work_sync() can also cancel a queued\nhandle_req before it picks the request up. Nobody completes\ncard->mrq_complete.\n\nOnce memstick core waits for requests without a timeout (\"memstick: core:\nwait for request completion before freeing card\"), this hangs removal:\nmemstick_check() never returns and memstick_remove_host() blocks in\nflush_workqueue():\n\n  INFO: task kworker/u10:3:65 blocked for more than 20 seconds.\n  Workqueue: kmemstick memstick_check\n   __wait_for_common\n   memstick_check\n\n  INFO: task kworker/1:1:33 blocked for more than 20 seconds.\n  Workqueue: usb_hub_wq hub_event\n   __flush_workqueue\n   memstick_remove_host\n   rtsx_usb_ms_drv_remove\n\nNever drop a request. rtsx_usb_ms_request() always schedules handle_req,\nand handle_req fails requests with -ENOMEDIUM once eject is set, without\ntouching the device. drv_remove flushes handle_req instead of cancelling\nit, and cancels it only after memstick_remove_host(), when no new\nrequest can arrive, so it cannot run on a freed host.\n\nThe host_mutex drain in drv_remove is removed: handle_req always leaves\nhost->req NULL when it finishes, so the drain never had anything to do,\nand it would now race with handle_req.","summary":"A race in the Linux kernel's rtsx_usb_ms memstick driver can drop a request during card removal, so the request never completes. The memstick core then waits forever, hanging the removal path and blocking the workqueue.","severity":"unknown","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","memstick","usb-card-reader","vendor"],"not_affected_if":["default-config"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-23T13:17:27+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:54:16+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-10-25T04:54:16Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Linux kernel: memstick driver can hang removal on rtsx_usb cards","impact":"low","summary":"A race in the Linux kernel's rtsx_usb_ms memstick driver can drop a request during card removal, so the request never completes. The memstick core then waits forever, hanging the removal path and blocking the workqueue.","category":"vendor","nicknames":[],"who_cares":["linux","kernel","usb-card-reader","memstick"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel hangs during memstick card removal, blocking workqueues.","analyst_note":"Check the upstream kernel stable commits for the fixed kernel versions and whether this is a denial-of-service only.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00056,"input_tokens":3825,"output_tokens":355,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99038':14A,17A '1':202C '20':188C,208C '3':182C '33':203C '65':183C 'also':129C 'alway':234C,295C 'anyth':308C 'arriv':275C 'block':61B,175C,184C,204C 'cancel':125C,130C,260C,263C 'cannot':278C 'card':11A,23B,43B,143C,163C 'check':87C,93C,168C,193C,198C 'common':196C 'complet':49B,78C,142C,145C,160C 'core':52B,148C,156C 'cve':12A,15A 'devic':252C 'drain':287C,305C 'driver':4A,37B 'drop':39B,84C,109C,227C 'drv':99C,122C,224C,253C,289C 'eject':81C,118C,246C 'eject/removing':102C 'enomedium':244C 'event':215C 'fail':241C 'finish':302C 'flush':177C,216C,255C 'follow':69C 'forev':55B 'free':162C 'freed':282C 'handl':133C,236C,239C,256C,293C,317C 'hang':6A,56B,165C 'host':91C,174C,220C,269C,283C,285C,297C 'hub':212C,214C 'info':179C,199C 'instead':82C,258C 'kernel':2A,18B,31B,67C 'kmemstick':191C 'kworker/1':201C 'kworker/u10':181C 'leav':296C 'linux':1A,19B,30B,66C 'memstick':3A,20B,36B,51B,74C,86C,147C,155C,167C,172C,192C,197C,218C,267C 'mrq':144C 'ms':35B,77C,98C,112C,223C,232C 'mutex':286C 'never':48B,169C,226C,306C 'new':272C 'next':104C 'nobodi':141C 'null':299C 'pass':89C 'path':59B 'pick':137C 'queu':132C 'race':27B,315C 'reader':24B 'remov':7A,44B,58B,92C,100C,123C,166C,173C,219C,225C,254C,268C,290C,292C 'req':134C,237C,240C,257C,294C,298C,318C 'request':41B,47B,79C,105C,113C,139C,151C,159C,229C,233C,242C,273C 'resolv':73C 'return':170C 'rtsx':9A,33B,75C,96C,110C,221C,230C 'run':279C 'schedul':115C,235C 'second':189C,209C 'set':101C,120C,248C 'silent':108C 'skip':114C 'sync':127C 'task':180C,200C 'timeout':154C 'touch':250C 'usb':10A,22B,34B,76C,97C,111C,211C,222C,231C 'usb-card-read':21B 'vendor':25B 'vulner':70C 'wait':54B,149C,157C,194C 'without':152C,249C 'work':116C,126C 'workqueu':63B,178C,190C,210C,217C 'would':313C 'wq':213C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99038","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99038","severity":null,"published_at":"2026-10-23T13:17:27+00:00","modified_at":"2026-10-23T13:17:27+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-99038","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99038","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}