{"id":"CVE-2026-99039","kind":"vulnerability","aliases":["CVE-2026-99039"],"related":[],"title":"Linux kernel: memstick timeout frees card still used by driver","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmemstick: core: wait for request completion before freeing card\n\nIn memstick_alloc_card() and memstick_set_rw_addr(),\nwait_for_completion_timeout() is used to wait for device identification\nand address configuration requests to complete.\n\nThe memstick subsystem does not provide an abort or cancellation\ncallback in struct memstick_host for in-flight requests. If\nwait_for_completion_timeout() expires (for instance, when a USB transfer\nor command retry is delayed), memstick_alloc_card() returns an error and\nfrees the memstick_dev structure via kfree(card).\n\nHowever, the host controller driver (such as rtsx_usb_ms) is still\nrunning the request asynchronously in worker context. When the transfer\neventually finishes, the driver writes into host->req->data, which\npoints to memory inside the already freed card structure. This leads to\na KASAN slab-use-after-free write:\n\n  BUG: KASAN: slab-use-after-free in ms_read_bytes+0x8fe/0x990\n  Write of size 1 at addr ffff88813c188079 by task kworker/1:5/5239\n  Workqueue: events rtsx_usb_ms_handle_req\n  Call Trace:\n   ms_read_bytes+0x8fe/0x990 drivers/memstick/host/rtsx_usb_ms.c:450\n   rtsx_usb_ms_issue_cmd drivers/memstick/host/rtsx_usb_ms.c:477 [inline]\n   rtsx_usb_ms_handle_req+0x557/0x1a00 drivers/memstick/host/rtsx_usb_ms.c:531\n   process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396\n   worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560\n   kthread+0x373/0x450 kernel/kthread.c:436\n\n  Allocated by task 1662:\n   memstick_alloc_card drivers/memstick/core/memstick.c:383 [inline]\n   memstick_check+0x2c1/0x10d0 drivers/memstick/core/memstick.c:452\n   process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396\n\n  Freed by task 1662:\n   kfree+0x20c/0x650 mm/slub.c:6792\n   memstick_alloc_card drivers/memstick/core/memstick.c:420 [inline]\n   memstick_check+0x72b/0x10d0 drivers/memstick/core/memstick.c:452\n   process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396\n\nHost controller drivers (rtsx_usb_ms, jmb38x_ms, tifm_ms, r592) already\nimplement their own hardware and bus timeouts, and callers in\nmspro_block and ms_block already rely on wait_for_completion()\nunconditionally.\n\nReplace wait_for_completion_timeout() with wait_for_completion() in\nmemstick_set_rw_addr() and memstick_alloc_card() so that the card\nstructure is never freed while an asynchronous request is in flight.","summary":"The memstick core stops waiting for a pending card request after a timeout and frees the card structure while the host controller driver can still write into it. This is a use-after-free that KASAN reports as a write into freed slab memory.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","memstick","self-hosted"],"not_affected_if":["memstick-modules-not-loaded","no-memstick-hardware"],"how_to_check":"- Check whether the kernel includes the memstick fix by looking for `wait_for_completion(` without `_timeout` in `drivers/memstick/core/memstick.c` in the source tree\n- Check whether memstick hardware such as rtsx_usb_ms is in use with `lsmod | grep -E 'rtsx_usb_ms|memstick'`","fix":"- Update the Linux kernel to a release that includes the commit replacing `wait_for_completion_timeout()` with `wait_for_completion()` in memstick_set_rw_addr() and memstick_alloc_card()\n- Versions are unknown from the sources","status":"open","published_at":"2026-10-23T13:17:27+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:54:17+00:00","updated_at":"2026-10-25T04:54:17+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:54:17Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the commit replacing `wait_for_completion_timeout()` with `wait_for_completion()` in memstick_set_rw_addr() and memstick_alloc_card()\n- Versions are unknown from the sources","reach":"local","title":"Linux kernel: memstick timeout frees card still used by driver","impact":"high","summary":"The memstick core stops waiting for a pending card request after a timeout and frees the card structure while the host controller driver can still write into it. This is a use-after-free that KASAN reports as a write into freed slab memory.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","memstick","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"kernel memory corruption from a write into freed memory","analyst_note":"Check the NVD entry and the upstream kernel commit for affected and fixed kernel versions and any CVSS score.","how_to_check":"- Check whether the kernel includes the memstick fix by looking for `wait_for_completion(` without `_timeout` in `drivers/memstick/core/memstick.c` in the source tree\n- Check whether memstick hardware such as rtsx_usb_ms is in use with `lsmod | grep -E 'rtsx_usb_ms|memstick'`","needs_analyst":true,"not_affected_if":["no-memstick-hardware","memstick-modules-not-loaded"],"who_is_affected":"Systems running a Linux kernel with memstick support (Memory Stick card readers, including rtsx_usb_ms USB readers) where a card identification or address request is delayed. Systems without memstick hardware or drivers loaded are unlikely to be exposed. The sources do not describe a remote trigger.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000751,"input_tokens":4271,"output_tokens":647,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':230C,255C,272C,279C,285C,290C,306C,313C,322C,334C,341C '-2026':12A,15A '-99039':13A,16A '1':235C '1662':297C,320C '3396':282C,316C,344C '3560':288C '383':302C '420':330C '436':293C '450':258C '452':309C,337C '477':265C '5/5239':242C '531':275C '6792':325C 'abort':122C 'addr':97C,237C,392C 'address':110C 'alloc':91C,153C,294C,299C,327C,395C 'alreadi':204C,356C,372C 'asynchron':182C,407C 'block':368C,371C 'bug':219C 'bus':362C 'byte':229C,254C 'call':250C 'callback':125C 'caller':365C 'cancel':124C 'card':6A,33B,41B,88C,92C,154C,166C,206C,300C,328C,396C,400C 'check':305C,333C 'cmd':263C 'command':148C 'complet':85C,100C,114C,138C,377C,382C,387C 'configur':111C 'context':185C 'control':46B,170C,346C 'core':27B,81C 'cve':11A,14A 'data':197C 'delay':151C 'dev':162C 'devic':107C 'driver':10A,47B,171C,192C,347C 'drivers/memstick/core/memstick.c':301C,308C,329C,336C 'drivers/memstick/host/rtsx_usb_ms.c':257C,264C,274C 'error':157C 'event':244C 'eventu':189C 'expir':140C 'ffff88813c188079':238C 'finish':190C 'flight':133C,411C 'follow':75C 'free':5A,39B,59B,87C,159C,217C,225C 'freed':67B,205C,317C,404C 'handl':248C,270C 'hardwar':360C 'host':24B,45B,129C,169C,195C,345C 'howev':167C 'identif':108C 'implement':357C 'in-flight':131C 'infrastructur':17B 'inlin':266C,303C,331C 'insid':202C 'instanc':142C 'issu':262C 'jmb38x':351C 'kasan':61B,212C,220C 'kernel':2A,20B,73C 'kernel/kthread.c':292C 'kernel/workqueue.c':281C,287C,315C,343C 'kfree':165C,321C 'kthread':289C 'kworker/1':241C 'lead':209C 'linux':1A,19B,72C 'linux-kernel':18B 'memori':69B,201C 'memstick':3A,21B,26B,80C,90C,94C,116C,128C,152C,161C,298C,304C,326C,332C,389C,394C 'mm/slub.c':324C 'ms':176C,227C,247C,252C,261C,269C,350C,352C,354C,370C 'mspro':367C 'never':403C 'one':277C,311C,339C 'pend':32B 'point':199C 'process':276C,310C,338C 'provid':120C 'r592':355C 'read':228C,253C 'reli':373C 'replac':379C 'report':62B 'req':196C,249C,271C 'request':34B,84C,112C,134C,181C,408C 'resolv':79C 'retri':149C 'return':155C 'rtsx':174C,245C,259C,267C,348C 'run':179C 'rw':96C,391C 'self':23B 'self-host':22B 'set':95C,390C 'size':234C 'slab':68B,214C,222C 'slab-use-after-fre':213C,221C 'still':7A,49B,178C 'stop':28B 'struct':127C 'structur':42B,163C,207C,401C 'subsystem':117C 'task':240C,296C,319C 'thread':284C 'tifm':353C 'timeout':4A,37B,101C,139C,363C,383C 'trace':251C 'transfer':146C,188C 'uncondit':378C 'usb':145C,175C,246C,260C,268C,349C 'use':8A,57B,103C,215C,223C 'use-after-fre':56B 'via':164C 'vulner':76C 'wait':29B,82C,98C,105C,136C,375C,380C,385C 'work':278C,312C,340C 'worker':184C,283C 'workqueu':243C 'write':50B,65B,193C,218C,232C 'x20c/0x650':323C 'x2c1/0x10d0':307C 'x373/0x450':291C 'x557/0x1a00':273C 'x5ef/0xe50':286C 'x72b/0x10d0':335C 'x8fe/0x990':231C,256C 'xac7/0x1b10':280C,314C,342C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with memstick support (Memory Stick card readers, including rtsx_usb_ms USB readers) where a card identification or address request is delayed. Systems without memstick hardware or drivers loaded are unlikely to be exposed. The sources do not describe a remote trigger.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99039","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99039","severity":null,"published_at":"2026-10-23T13:17:27+00:00","modified_at":"2026-10-23T13:17:27+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}