CVE-2026-99039

A flaw was found in the Linux kernel's memstick subsystem. This vulnerability allows a local user or physically proximate attacker to cause a Denial of Service (DoS) or kernel memory corruption. When device initialization or configuration requests experience a timeout, the kernel prematurely frees the memory structure associated with the card while asynchronous hardware operations remain active. When the delayed operation completes, the host controller driver writes into the released memory, triggering a use-after-free condition that leads to a system crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.