During a memstick removal that uses the rtsx_usb_ms driver, the kernel does not drop pending requests after the device is marked for ejection; instead it attempts to complete them, leading to a hang of the worker queue. The hang manifests as blocked kworker tasks for over 20 seconds and a deadlock in the memstick removal sequence. The result is a denial‑of‑service condition where the system cannot complete shutdown or normal I/O until a reboot.

The vulnerability exists in any Linux kernel that builds with the rtsx_usb_ms memstick driver – essentially all distributions that ship a recent kernel with this driver compiled. Until the patch that reorders request handling is applied, those systems are vulnerable.

The CVSS score of 4.7 indicates moderate severity. The EPSS score is <1% and the flaw is not listed in the CISA KEV catalog, suggesting no known active exploitation. Based on the description, it is inferred that an attacker must have local or physical access to trigger the flaw by removing a memstick device while the driver is active; the likely attack vector is physically unplugging the device during normal operation. The flaw does not provide privilege escalation or data leakage but can suspend the system. The overall risk is low, yet in a worst‑case scenario it can cause a system hang.