UBUNTU-CVE-2026-98227: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: memstick: msblock: destroy ioqueue workqueue on removal msbinitdisk() creates the per-card ordered workqueue msb->ioqueue with allocorderedworkqueue(). It is torn down with destroyworkqueue() only on the init error path; msbremove() never destroys it. msbstop() merely flushes the queue, and neither msbdataclear() nor putdisk() free it. As a result every card insert/remove cycle leaks the workqueue and its kworker, exhausting kernel memory over repeated cycles. Destroy the workqueue in msbremove() after the disk has been removed and the queue drained.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In msb_remove(), destroy the per-card msb->io_queue workqueue with destroy_workqueue() after the disk has been removed and the queue has been drained.
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
Systems running one of the listed Ubuntu kernel packages are exposed when they use Memory Stick cards through the memstick block driver. The leak occurs on repeated card insertion and removal cycles.
What does an attacker need to do to trigger the resource leak?
The issue is triggered by repeatedly inserting and removing a Memory Stick card. Each removal leaves the per-card ordered workqueue and its kworker allocated, eventually exhausting kernel memory.
What can be done if an updated kernel cannot be installed immediately?
Avoid repeated Memory Stick card insertion and removal cycles on affected systems. Reducing or disabling use of the affected memstick block-device functionality limits opportunities to accumulate leaked workqueues.
How can administrators tell whether a system may be affected?
A potentially affected system runs a listed Ubuntu kernel package and handles Memory Stick cards. Repeated card cycling may result in accumulating kworker/workqueue allocations and kernel-memory exhaustion.