In the Linux kernel, the following vulnerability has been resolved: memstick: rtsx_usb_ms: complete requests after eject instead of dropping them… (CVE-2026-99038)

The Linux kernel vulnerability CVE-2026-99038 concerns the memstick subsystem's rtsx_usb_ms driver, where requests could be silently dropped after a card eject event. Specifically, memstick_check() could pass the host->removing check before rtsx_usb_ms_drv_remove() sets the eject/removing flags. Subsequent requests were dropped because rtsx_usb_ms_request() skipped scheduling work once eject was set, and cancel_work_sync() could cancel queued request handlers before they processed requests. This caused memstick_check() to block indefinitely waiting for request completion, hanging the removal process. The fix changes rtsx_usb_ms_request() to always schedule request handling and fail requests with -ENOMEDIUM after eject, and modifies drv_remove to flush rather than cancel work, preventing races and hangs.

The vulnerability causes the Linux kernel to hang during the removal of memstick devices using the rtsx_usb_ms driver, due to requests being dropped and never completed. This results in blocked kernel worker threads and potentially stalled device removal operations. There is no indication of data corruption or privilege escalation, but system stability and device management are affected.

A fix for this vulnerability has been implemented in the Linux kernel. Users should update to a kernel version that includes this patch to prevent hangs during memstick device removal. Since this is a kernel-level fix, applying the official kernel update is the recommended remediation. No additional mitigation steps are indicated.