{"identifier":"CVE-2026-99038","cve":{"id":"CVE-2026-99038","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmemstick: rtsx_usb_ms: complete requests after eject instead of dropping them\n\nmemstick_check() can pass its host->removing check just before\nrtsx_usb_ms_drv_remove() sets eject/removing. Its next request is then\nsilently dropped: rtsx_usb_ms_request() skips schedule_work() once eject\nis set, and drv_remove's cancel_work_sync() can also cancel a queued\nhandle_req before it picks the request up. Nobody completes\ncard->mrq_complete.\n\nOnce memstick core waits for requests without a timeout (\"memstick: core:\nwait for request completion before freeing card\"), this hangs removal:\nmemstick_check() never returns and memstick_remove_host() blocks in\nflush_workqueue():\n\n  INFO: task kworker/u10:3:65 blocked for more than 20 seconds.\n  Workqueue: kmemstick memstick_check\n   __wait_for_common\n   memstick_check\n\n  INFO: task kworker/1:1:33 blocked for more than 20 seconds.\n  Workqueue: usb_hub_wq hub_event\n   __flush_workqueue\n   memstick_remove_host\n   rtsx_usb_ms_drv_remove\n\nNever drop a request. rtsx_usb_ms_request() always schedules handle_req,\nand handle_req fails requests with -ENOMEDIUM once eject is set, without\ntouching the device. drv_remove flushes handle_req instead of cancelling\nit, and cancels it only after memstick_remove_host(), when no new\nrequest can arrive, so it cannot run on a freed host.\n\nThe host_mutex drain in drv_remove is removed: handle_req always leaves\nhost->req NULL when it finishes, so the drain never had anything to do,\nand it would now race with handle_req.","published":"2026-10-23T13:17:27.067000+00:00","modified":"2026-10-23T13:17:27.067000+00:00","status":"Received","score":null,"severity":"UNSCORED","vector":"","cvss_version":"","affected":[],"weaknesses":[],"references":[{"url":"https://git.kernel.org/stable/c/5616da0f92339328fa1472876df51555e15ad340","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5b599e28aeb3684772aef64f46cc6f25f4c67128","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c96ca94425b076dc398d929366e378d1e22ec794","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d7e811c3a49cd5cff529c157df886719e09370ec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f2c181e1d58e911804e14543b2f1cc6b23a0d4d6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"kev":null,"kev_checked":true,"metrics":{},"configurations":[],"source":"nvd","retrieved_at":"2026-10-28T10:20:57.606768+00:00","exploited":false,"kev_stale":false,"products":[],"priority":{"label":"Assess exposure and vendor guidance","reasons":["No higher-priority signal is available in the current stored evidence."]},"epss":{"probability":0.00168,"percentile":0.0613,"date":"2026-10-28","stale":false},"version_assessment":null},"news":[],"campaigns":[],"domains":[{"domain":"git.kernel.org","source_url":"https://git.kernel.org/stable/c/5616da0f92339328fa1472876df51555e15ad340","investigate_url":"https://investigate.aeglixmind.com/#git.kernel.org"}],"arsenal_url":"https://arsenal.aeglixmind.com/?cve=CVE-2026-99038","catalog_url":"https://cves.aeglixmind.com/cve/CVE-2026-99038","research_url":"https://investigate.aeglixmind.com/research/cve/CVE-2026-99038","coverage":{"news_candidates_checked":0,"campaign_candidates_checked":0,"bounded":false,"notice":"Exact CVE mentions in stored public excerpts and reviewed campaign content only. A mention is not proof of exploitation, attribution or tool suitability. Missing matches do not establish absence."}}