CVE-2026-98227: memstick: ms_block: destroy io_queue workqueue on removal
In the Linux kernel, the following vulnerability has been resolved:
memstick: msblock: destroy ioqueue workqueue on removal
msbinitdisk() creates the per-card ordered workqueue msb->ioqueue with allocorderedworkqueue(). It is torn down with destroyworkqueue() only on the init error path; msbremove() never destroys it. msbstop() merely flushes the queue, and neither msbdataclear() nor putdisk() free it. As a result every card insert/remove cycle leaks the workqueue and its kworker, exhausting kernel memory over repeated cycles.
Destroy the workqueue in msbremove() after the disk has been removed and the queue drained.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.189 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.158 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.112 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.54 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.8 - Compensating control
In the Linux kernel memstick ms_block driver, destroy the per-card msb->io_queue workqueue in msb_remove() after the disk has been removed and the queue has been drained.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel's Memory Stick block driver are exposed when Memory Stick cards are repeatedly inserted and removed. Each removal can leave behind a per-card workqueue and its kworker.
What conditions are required to trigger the resource leak?
The issue is triggered by repeated Memory Stick card insertion and removal cycles. A single cycle leaks the workqueue; repeated cycles can exhaust kernel memory.
How can an administrator recognize that a system may be affected?
Affected systems may show accumulating kernel workqueues or kworker threads associated with repeated Memory Stick card use, along with growing kernel memory consumption. The leak occurs because the per-card io_queue is flushed but not destroyed during device removal.