---
id: CVE-2026-99038
title: 'memstick: rtsx_usb_ms: complete requests after eject instead of dropping them'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  memstick: rtsx_usb_ms: complete requests after eject instead of dropping them

  memstick_check() can pass its host->removing check just before
  rtsx_usb_ms_drv_remove() s…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 99451dceeb5fdd789f0a2eeb3ee029e80d2ccc40 <
    f2c181e1d58e911804e14543b2f1cc6b23a0d4d6
  - >-
    Linux >= 99451dceeb5fdd789f0a2eeb3ee029e80d2ccc40 <
    5b599e28aeb3684772aef64f46cc6f25f4c67128
  - >-
    Linux >= 99451dceeb5fdd789f0a2eeb3ee029e80d2ccc40 <
    d7e811c3a49cd5cff529c157df886719e09370ec
  - >-
    Linux >= 99451dceeb5fdd789f0a2eeb3ee029e80d2ccc40 <
    5616da0f92339328fa1472876df51555e15ad340
  - >-
    Linux >= 99451dceeb5fdd789f0a2eeb3ee029e80d2ccc40 <
    c96ca94425b076dc398d929366e378d1e22ec794
  - Linux 3.16
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:21:56.333Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99038'
references:
  - url: 'https://git.kernel.org/stable/c/f2c181e1d58e911804e14543b2f1cc6b23a0d4d6'
  - url: 'https://git.kernel.org/stable/c/5b599e28aeb3684772aef64f46cc6f25f4c67128'
  - url: 'https://git.kernel.org/stable/c/d7e811c3a49cd5cff529c157df886719e09370ec'
  - url: 'https://git.kernel.org/stable/c/5616da0f92339328fa1472876df51555e15ad340'
  - url: 'https://git.kernel.org/stable/c/c96ca94425b076dc398d929366e378d1e22ec794'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.529Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

memstick: rtsx_usb_ms: complete requests after eject instead of dropping them

memstick_check() can pass its host->removing check just before
rtsx_usb_ms_drv_remove() sets eject/removing. Its next request is then
silently dropped: rtsx_usb_ms_request() skips schedule_work() once eject
is set, and drv_remove's cancel_work_sync() can also cancel a queued
handle_req before it picks the request up. Nobody completes
card->mrq_complete.

Once memstick core waits for requests without a timeout ("memstick: core:
wait for request completion before freeing card"), this hangs removal:
memstick_check() never returns and memstick_remove_host() blocks in
flush_workqueue():

  INFO: task kworker/u10:3:65 blocked for more than 20 seconds.
  Workqueue: kmemstick memstick_check
   __wait_for_common
   memstick_check

  INFO: task kworker/1:1:33 blocked for more than 20 seconds.
  Workqueue: usb_hub_wq hub_event
   __flush_workqueue
   memstick_remove_host
   rtsx_usb_ms_drv_remove

Never drop a request. rtsx_usb_ms_request() always schedules handle_req,
and handle_req fails requests with -ENOMEDIUM once eject is set, without
touching the device. drv_remove flushes handle_req instead of cancelling
it, and cancels it only after memstick_remove_host(), when no new
request can arrive, so it cannot run on a freed host.

The host_mutex drain in drv_remove is removed: handle_req always leaves
host->req NULL when it finishes, so the drain never had anything to do,
and it would now race with handle_req.

## Affected

- `Linux >= 99451dceeb5fdd789f0a2eeb3ee029e80d2ccc40 < f2c181e1d58e911804e14543b2f1cc6b23a0d4d6`
- `Linux >= 99451dceeb5fdd789f0a2eeb3ee029e80d2ccc40 < 5b599e28aeb3684772aef64f46cc6f25f4c67128`
- `Linux >= 99451dceeb5fdd789f0a2eeb3ee029e80d2ccc40 < d7e811c3a49cd5cff529c157df886719e09370ec`
- `Linux >= 99451dceeb5fdd789f0a2eeb3ee029e80d2ccc40 < 5616da0f92339328fa1472876df51555e15ad340`
- `Linux >= 99451dceeb5fdd789f0a2eeb3ee029e80d2ccc40 < c96ca94425b076dc398d929366e378d1e22ec794`
- `Linux 3.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.