{
  "cveId": "CVE-2026-99038",
  "url": "https://patchblox.com/security/cve/CVE-2026-99038",
  "summary": "CVE-2026-99038 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-99038, released October 24, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "memstick: rtsx_usb_ms: complete requests after eject instead of dropping them",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  memstick: rtsx_usb_ms: complete requests after eject instead of dropping them  memstick_check() can pass its host-\u003Eremoving check just before rtsx_usb_ms_drv_remove() sets eject/removing. Its next request is then silently dropped: rtsx_usb_ms_request() skips schedule_work() once eject is set, and drv_remove\u0027s cancel_work_sync() can also cancel a queued handle_req before it picks the request up. Nobody completes card-\u003Emrq_complete.  Once memstick core waits for requests without a timeout (\u0022memstick: core: wait for request completion before freeing card\u0022), this hangs removal: memstick_check() never returns and memstick_remove_host() blocks in flush_workqueue():    INFO: task kworker/u10:3:65 blocked for more than 20 seconds.   Workqueue: kmemstick memstick_check    __wait_for_common    memstick_check    INFO: task kworker/1:1:33 blocked for more than 20 seconds.   Workqueue: usb_hub_wq hub_event    __flush_workqueue    memstick_remove_host    rtsx_usb_ms_drv_remove  Never drop a request. rtsx_usb_ms_request() always schedules handle_req, and handle_req fails requests with -ENOMEDIUM once eject is set, without touching the device. drv_remove flushes handle_req instead of cancelling it, and cancels it only after memstick_remove_host(), when no new request can arrive, so it cannot run on a freed host.  The host_mutex drain in drv_remove is removed: handle_req always leaves host-\u003Ereq NULL when it finishes, so the drain never had anything to do, and it would now race with handle_req.",
  "published": "2026-10-23T13:17:27Z",
  "severity": "Moderate",
  "cvss": 4.2,
  "epss": 0.00177,
  "epssPercentile": 0.07302,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-99038",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.113-1",
      "fix": "DEBIAN-CVE-2026-99038",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-99038",
      "released": "2026-10-24T13:25:57Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.11-1",
      "fix": "DEBIAN-CVE-2026-99038",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-99038",
      "released": "2026-10-24T13:25:57Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}