Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-98227

memstick: ms_block: destroy io_queue workqueue on removal

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: memstick: ms_block: destroy io_queue workqueue on removal msb_init_disk() creates the per-card ordered workqueue msb->io_queue with alloc_ordered_workqueue(). It is torn down with destroy_workqueue() only on the init error path; msb_remove() never destroys it. msb_stop() merely flushes the queue, and neither msb_data_clear() nor put_disk() free it. As a result every card insert/remove cycle leaks the workqueue and its kworker, exhausting kernel memory over repeated cycles. Destroy the workqueue in msb_remove() after the disk has been removed and the queue drained.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 0ab30494bc4f3bc1ea4659b7c5d97c5218554a63 to < 0ff795163f37109a134b5a421558530f8d091544affected
  • 0ab30494bc4f3bc1ea4659b7c5d97c5218554a63 to < 19c3da6621a253f1f8b937ed91bc22330a930d9caffected
  • 0ab30494bc4f3bc1ea4659b7c5d97c5218554a63 to < 9a2e7cdc0880e735aff0968ee402f2c92a992b9baffected
  • 0ab30494bc4f3bc1ea4659b7c5d97c5218554a63 to < 6611f78ec3fd4b33a00bfda20725b254a22979f6affected
  • 0ab30494bc4f3bc1ea4659b7c5d97c5218554a63 to < f222bb8c30cf5699c560b29179ff2bddcac1f950affected
  • 0ab30494bc4f3bc1ea4659b7c5d97c5218554a63 to < 90af7fde083e1b22c349c3a8b1626728e44e474caffected

Linux Linux

Default version status: affected

  • 3.12affected
  • 0 to < 3.12unaffected
  • 6.1.189 to ≤ 6.1.*unaffected
  • 6.6.158 to ≤ 6.6.*unaffected
  • 6.12.112 to ≤ 6.12.*unaffected
  • 6.18.54 to ≤ 6.18.*unaffected
  • 7.2.8 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References