All vulnerabilities
CVE-2026-98212

Linux: mmc: hsq: Fix use-after-free in retry work

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in8439bf262ce3267bcfee29d3c61605f1731a2271Also 45341b341642c377192c95e4d48e0a859cf85f42, 5d132990475f02cfa1debe03d50b479432864ebdCVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 8439bf262ce3267bcfee29d3c61605f1731a2271LinuxCVE List
  • 45341b341642c377192c95e4d48e0a859cf85f42LinuxCVE List
  • 5d132990475f02cfa1debe03d50b479432864ebdLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

mmc: hsq: Fix use-after-free in retry work

mmc_hsq_pump_requests() queues retry_work when request_atomic() returns -EBUSY; today sdhci-sprd is the only consumer that implements request_atomic(). The work is embedded in a devm-allocated mmc_hsq, but is never cancelled during driver removal. Work still pending at unbind can therefore run after the devm allocation has been released and dereference hsq->mmc and hsq->mrq.

Use devm_work_autocancel() to cancel and drain retry_work before the devm allocation is released. By the time devres cleanup begins, mmc_remove_host() has already stopped the host, so no new requests can arm the work.

This issue was found by an in-house static analysis tool.

Text from CVE List

Affected versions 12

  • Linuxaffected: 6db96e5810e0a6a345b7d78549de7676ae5b2662 before c50d6515bffb148c2c12be6d587ec201dfab4c34CVE List
  • Linuxaffected: 6db96e5810e0a6a345b7d78549de7676ae5b2662 before df2eb59fd9eb33663dc1053f5a4ed851e0aa1f67CVE List
  • Linuxaffected: 6db96e5810e0a6a345b7d78549de7676ae5b2662 before 8439bf262ce3267bcfee29d3c61605f1731a2271CVE List
  • Linuxaffected: 6db96e5810e0a6a345b7d78549de7676ae5b2662 before 45341b341642c377192c95e4d48e0a859cf85f42CVE List
  • Linuxaffected: 6db96e5810e0a6a345b7d78549de7676ae5b2662 before 5d132990475f02cfa1debe03d50b479432864ebdCVE List
  • Linuxaffected: 5.8CVE List
  • Linuxunaffected: all versions before 5.8CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5