CVE-2026-98227

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: memstick: ms_block: destroy io_queue workqueue on removal msb_init_disk() creates the per-card ordered workqueue msb->io_queue with alloc_ordered_workqueue(). It is torn down with destroy_workqueue() only on the init error path; msb_remove() never destroys it. msb_stop() merely flushes the queue, and neither msb_data_clear() nor put_disk() free it. As a result every card insert/remove cycle leaks the workqueue and its kworker, exhausting kernel memory over repeated cycles. Destroy the workqueue in msb_remove() after the disk has been removed and the queue drained.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98227

EUVD

EUVD-2026-93155

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	0ab30494bc4f3bc1ea4659b7c5d97c5218554a63
Linux	Linux	0ab30494bc4f3bc1ea4659b7c5d97c5218554a63
Linux	Linux	0ab30494bc4f3bc1ea4659b7c5d97c5218554a63
Linux	Linux	0ab30494bc4f3bc1ea4659b7c5d97c5218554a63
Linux	Linux	0ab30494bc4f3bc1ea4659b7c5d97c5218554a63
Linux	Linux	0ab30494bc4f3bc1ea4659b7c5d97c5218554a63
Linux	Linux	3.12

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a memory leak in the memstick subsystem. The msb_init_disk function creates a workqueue called io_queue for memory stick devices, but this queue is not properly destroyed when devices are removed. Instead, it is only flushed, causing the workqueue and its associated kernel worker threads to leak memory every time a device is inserted and removed repeatedly.

Detection Guidance

This vulnerability is specific to the Linux kernel's memstick subsystem and involves a memory leak in the ms_block driver. Detection requires checking for kernel logs or memory usage patterns indicating workqueue leaks in the memstick subsystem. Commands like dmesg | grep -i memstick or monitoring slabtop for growing workqueue allocations may help identify the issue.

Impact Analysis

This vulnerability can lead to kernel memory exhaustion over time. If you frequently insert and remove memory stick devices, the leaked workqueues and kworkers will consume increasing amounts of memory, potentially causing system slowdowns, crashes, or denial of service due to out-of-memory conditions.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a kernel memory leak issue in the Linux memstick subsystem that could lead to resource exhaustion over time. Compliance impacts would only occur if the vulnerability caused system instability or data corruption, which is not described here.

Mitigation Strategies

Apply the kernel patch that resolves this issue by ensuring the workqueue is properly destroyed in msb_remove(). Update to a patched kernel version or apply the specific patch for CVE-2026-98227. Avoid frequent card insert/remove cycles until patched to prevent memory exhaustion.

Hi! I’m here to help you understand CVE-2026-98227. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70