Missing Release of Resource after Effective Lifetime in Linux kernel - CVE-2026-98227

Vulnerability details

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to failure to release allocated workqueue resources in the Linux kernel Memory Stick block driver when removing a memory card. An attacker with physical access can repeatedly insert and remove a memory card to cause a denial of service.

Each insertion and removal cycle leaks the per-card workqueue and its worker thread, progressively exhausting kernel memory.

Affected software

How to mitigate CVE-2026-98227

External References

• https://git.kernel.org/stable/c/0ff795163f37109a134b5a421558530f8d091544
• https://git.kernel.org/stable/c/19c3da6621a253f1f8b937ed91bc22330a930d9c
• https://git.kernel.org/stable/c/6611f78ec3fd4b33a00bfda20725b254a22979f6
• https://git.kernel.org/stable/c/90af7fde083e1b22c349c3a8b1626728e44e474c
• https://git.kernel.org/stable/c/9a2e7cdc0880e735aff0968ee402f2c92a992b9b
• https://git.kernel.org/stable/c/f222bb8c30cf5699c560b29179ff2bddcac1f950

Related Security Bulletins

• Missing Release of Resource after Effective Lifetime in Linux kernel memstick core driver
• Debian update for linux