{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-98227",
  "modified": "2026-10-07T17:22:01Z",
  "upstream": [
    "CVE-2026-98227"
  ],
  "published": "2026-10-06T08:47:10Z",
  "summary": "memstick: ms_block: destroy io_queue workqueue on removal",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemstick: ms_block: destroy io_queue workqueue on removal\n\nmsb_init_disk() creates the per-card ordered workqueue msb->io_queue with\nalloc_ordered_workqueue(). It is torn down with destroy_workqueue() only\non the init error path; msb_remove() never destroys it. msb_stop() merely\nflushes the queue, and neither msb_data_clear() nor put_disk() free it. As\na result every card insert/remove cycle leaks the workqueue and its\nkworker, exhausting kernel memory over repeated cycles.\n\nDestroy the workqueue in msb_remove() after the disk has been removed and\nthe queue drained.",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.189",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98227"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/0ff795163f37109a134b5a421558530f8d091544"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/19c3da6621a253f1f8b937ed91bc22330a930d9c"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/9a2e7cdc0880e735aff0968ee402f2c92a992b9b"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/6611f78ec3fd4b33a00bfda20725b254a22979f6"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/f222bb8c30cf5699c560b29179ff2bddcac1f950"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/90af7fde083e1b22c349c3a8b1626728e44e474c"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-10-06T08:47:10Z"
  }
}