In the Linux kernel, the following vulnerability has been resolved: memstick: core: wait for request completion before freeing card In… (CVE-2026-99039)

The Linux kernel memstick subsystem used wait_for_completion_timeout() in memstick_alloc_card() and memstick_set_rw_addr() to wait for device identification and address configuration requests. If the timeout expired, memstick_alloc_card() would free the memstick_dev structure, but asynchronous requests could still be running in the host controller driver (e.g., rtsx_usb_ms). When these requests completed, they wrote to memory that had already been freed, causing a KASAN slab-use-after-free error. The fix replaced wait_for_completion_timeout() with wait_for_completion() to ensure the card structure is never freed while asynchronous requests are active.

This vulnerability could lead to a kernel use-after-free condition, potentially causing system instability or crashes. The issue arises from asynchronous requests writing to freed memory, which may result in memory corruption or kernel panics. There is no indication of known exploits in the wild.

The vulnerability has been resolved by replacing wait_for_completion_timeout() with wait_for_completion() in the affected functions, ensuring that the card structure is not freed while asynchronous requests are still in flight. Users should update to the fixed Linux kernel version containing this patch. No additional mitigation actions are indicated.