{"schema":"threatline.record/2","record":{"id":"CVE-2026-99035","aliases":[],"summary":"mmc: mtk-sd: Cancel request timeout work on remove","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: mtk-sd: Cancel request timeout work on remove\n\nThe driver queues req_timeout while a request is active.\nmsdc_request_done() uses cancel_delayed_work(), which does not wait for\na timeout callback that has already started.\n\nThe timeout callback calls mmc_request_done(), which wakes the request\nwaiter, and then continues to use host->dev_comp and check the SDIO IRQ.\nDuring unbind, msdc_drv_remove() can return and the managed mmc_host can\nbe freed before the callback finishes.\n\nKASAN reported use-after-free accesses in msdc_request_done() and\nmsdc_recheck_sdio_irq() in each of three unbind tests.  The same tests\ncompleted without a kernel diagnostic after this change.\n\nCall cancel_delayed_work_sync() after mmc_remove_host() has stopped new\nrequests and before the driver releases the host resources.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-99035","source_modified_at":"2026-10-23T12:21:44.522Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Linux","vendor":"Linux","versions":[{"version":"208489032bdd8d4a7de50f3057c175058f271956","lessThan":"9e799f25c420e759641eb25102967ea091fc758f","status":"affected","versionType":"git"},{"version":"208489032bdd8d4a7de50f3057c175058f271956","lessThan":"f37e0367ad6f2147a0b37564b442b7a25bec0d23","status":"affected","versionType":"git"},{"version":"208489032bdd8d4a7de50f3057c175058f271956","lessThan":"46e75703ca3f00fb8c935b3ce35b90836e34e8af","status":"affected","versionType":"git"},{"version":"208489032bdd8d4a7de50f3057c175058f271956","lessThan":"edef1355224c0799a502a46b71d3649fa0dd218e","status":"affected","versionType":"git"},{"version":"208489032bdd8d4a7de50f3057c175058f271956","lessThan":"b38af5386a74416e898955443f2e26547b358cb2","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-99035","source_modified_at":"2026-10-23T12:21:44.522Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Linux","vendor":"Linux","versions":[{"version":"4.2","status":"affected"},{"version":"0","lessThan":"4.2","status":"unaffected","versionType":"semver"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.113","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.11","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-99035","source_modified_at":"2026-10-23T12:21:44.522Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"9e799f25c420e759641eb25102967ea091fc758f","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-99035","source_modified_at":"2026-10-23T12:21:44.522Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"46e75703ca3f00fb8c935b3ce35b90836e34e8af","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-23T12:21:44.522Z","modified_at":"2026-10-23T12:21:44.522Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-99035","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T12:21:44.522Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/9e799f25c420e759641eb25102967ea091fc758f"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/f37e0367ad6f2147a0b37564b442b7a25bec0d23"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/46e75703ca3f00fb8c935b3ce35b90836e34e8af"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/edef1355224c0799a502a46b71d3649fa0dd218e"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/b38af5386a74416e898955443f2e26547b358cb2"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-23T12:21:44.522Z","content_hash":"b1c3073025eb755498dfff8f792d1a9fe89c1fda66470f331eb24e443186d588"}}