CVE-2026-98227 memstick: ms_block: destroy io_queue workqueue on removal
Repeated memstick card insertions leak kernel memory, potentially causing system denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-98227?
CVE-2026-98227 is a denial of service vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In the Linux kernel, the following vulnerability has been resolved:
memstick: ms_block: destroy io_queue workqueue on removal
msb_init_disk() creates the per-card ordered workqueue msb->io_queue with alloc_ordered_workqueue(). It is torn down with destroy_workqueue() only on the init error path; msb_remove() never destroys it. msb_stop() merely flushes the queue, and neither msb_data_clear() nor put_disk() free it. As a result every card insert/remove cycle leaks the workqueue and its kworker, exhausting kernel memory over repeated cycles.
Destroy the workqueue in msb_remove() after the disk has been removed and the queue drained.
Which versions are affected by CVE-2026-98227?
How do I fix CVE-2026-98227?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-98227 being exploited?
There is no known exploitation of CVE-2026-98227 in the wild and no public exploit code.
Sources
Also known as AZL-106299, BELL-CVE-2026-98227, DEBIAN-CVE-2026-98227, GHSA-4xvx-jjq9-8pfx, UBUNTU-CVE-2026-98227.