PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-99038 Linux CVE debrief

A Linux kernel vulnerability allows requests to be dropped instead of completed after eject, potentially causing removal to hang. This issue arises in the memstick: rtsx_usb_ms driver, where memstick_check() can pass its host->removing check just before rtsx_usb_ms_drv_remove() sets eject/removing. Its next request is then silently dropped: rtsx_usb_ms_request() skips schedule_work() once eject is set, and drv_remove's cancel_work_sync() can also cancel a queued handle_req before it picks the request up. Nobody completes card->mrq_complete. Once memstick core waits for requests without a timeout (memstick: core: wait for request completion before freeing card), this hangs removal.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-23
Original CVE updated
2026-10-30
Advisory published
2026-10-23
Advisory updated
2026-10-30

Who should care

Linux administrators and developers, ensure system uptime and stability by verifying and applying patches. This vulnerability affects Linux kernel versions 3.16 and later, and memstick removal procedures should be reviewed to ensure smooth operation. Operators, platform managers, and security teams should be aware of the potential impact on system uptime and stability.

Why it matters

Linux kernel vulnerability allows requests to be dropped instead of completed after eject, potentially causing removal to hang.

  • Verify Linux kernel version and apply patches to prevent removal hang
  • Monitor system uptime and stability to detect potential issues
  • Review memstick removal procedures to ensure smooth operation

Technical summary

The Linux kernel vulnerability causes requests to be dropped instead of completed after eject, potentially causing removal to hang. This issue arises in the memstick: rtsx_usb_ms driver, where memstick_check() can pass its host->removing check just before rtsx_usb_ms_drv_remove() sets eject/removing. The vulnerability can be addressed by verifying and applying patches for Linux kernel versions 3.16 and later, ensuring system uptime and stability, and reviewing memstick removal procedures to ensure smooth operation.

Defensive priority

Verify and apply patches for Linux kernel versions 3.16 and later; ensure system uptime and stability.

Recommended defensive actions

  • Verify Linux kernel version and apply patches
  • Monitor system uptime and stability
  • Review memstick removal procedures
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The Linux kernel vulnerability causes memstick removal to hang due to dropped requests. Official CVE and NVD records provide details. The vulnerability is located in the rtsx_usb_ms driver, which fails to complete requests after eject. This issue can be verified by reviewing the Linux kernel patch and official CVE record. The memstick core waits for requests without a timeout, leading to a hang in removal.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-99038 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-99038

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-99038 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-99038

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • memstick: rtsx_usb_ms: complete requests after eject instead of dropping them

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/99xxx/CVE-2026-99038.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c48245ef696e590e92cbfb622625642bec8dbbad

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/602a00d75d2ab079c9ab7c0d7b56ae436e604148

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8e4eda6e1b00624820fea1d35508d7422330ee25

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f2c181e1d58e911804e14543b2f1cc6b23a0d4d6

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5b599e28aeb3684772aef64f46cc6f25f4c67128

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d7e811c3a49cd5cff529c157df886719e09370ec

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5616da0f92339328fa1472876df51555e15ad340

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.