Vulnerability feed

Executive summary

A flaw in the Linux kernel's memstick subsystem can cause memory corruption when a memory stick device is being identified and the request times out. The advisory describes this as a use-after-free bug that can be triggered by a delayed USB transfer or command retry. The advisory does not state a severity score, and the fix it describes is to wait for the in-flight request to complete rather than freeing the card early.

Technical summary

The vulnerability is a use-after-free (CWE class not stated, but described as a KASAN slab-use-after-free write) in the Linux kernel memstick core. In memstick_alloc_card() and memstick_set_rw_addr(), wait_for_completion_timeout() can expire while a host controller driver such as rtsx_usb_ms still runs the request, after which the card structure is freed and the driver later writes into it. The advisory does not state a CVSS score or attack vector details beyond a delayed USB transfer or command retry as a trigger. The fixed version is not stated. The advisory states the fix is to replace wait_for_completion_timeout() with wait_for_completion() in memstick_set_rw_addr() and memstick_alloc_card(). No workarounds or detection guidance are stated, and whether the issue has been exploited in the wild is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Score

No CVSS score published.

Affects

LinuxLinuxLinux kernelLinux memstick