CVE-2026-98227

In the Linux kernel, the following vulnerability has been resolved:

memstick: ms block: destroy io queue workqueue on removal

msb init disk() creates the per-card ordered workqueue msb->io queue with alloc ordered workqueue(). It is torn down with destroy workqueue() only on the init error path; msb remove() never destroys it. msb stop() merely flushes the queue, and neither msb data clear() nor put disk() free it. As a result every card insert/remove cycle leaks the workqueue and its kworker, exhausting kernel memory over repeated cycles.

Destroy the workqueue in msb remove() after the disk has been removed and the queue drained.