All vulnerabilities
CVE-2026-98213

Linux: mmc: core: Cancel SDIO IRQ work before freeing host

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0bf3d168a2cc20b120d6b50f0a8ac5b40ff4d589Also 1d6e7315ee1c992b4ca42c9b11c5ed0e925a00e0, 4553b5004eca9c9eae29a421f1a9c4d5db2c9114 and 2 moreCVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 0bf3d168a2cc20b120d6b50f0a8ac5b40ff4d589LinuxCVE List
  • 1d6e7315ee1c992b4ca42c9b11c5ed0e925a00e0LinuxCVE List
  • 4553b5004eca9c9eae29a421f1a9c4d5db2c9114LinuxCVE List
  • 2a863458828ade0671c2bc2e469bbd7f2340eb03LinuxCVE List
  • 6feadbecdae60a6324c967f3b1493741083793a3LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

mmc: core: Cancel SDIO IRQ work before freeing host

A host controller that uses sdio_signal_irq() schedules host->sdio_irq_work from its interrupt handler. That work is only cancelled on the suspend path (mmc_sdio_suspend()), not on the remove/free path, so a worker armed just before the controller freed its IRQ can run after mmc_host_classdev_release() has freed the host and dereference it through container_of().

Cancel host->sdio_irq_work in mmc_free_host(), like the existing host->detect drain added by commit 1036f69e2513 ("mmc: core: Cancel delayed work before releasing host").

This issue was found by an in-house static analysis tool.

Text from CVE List

Affected versions 14

  • Linuxaffected: 682696605c7093d2800c498c04166831e5aedf87 before bae1cf4f9902b2065bd78b759c7fe6312855f05eCVE List
  • Linuxaffected: 682696605c7093d2800c498c04166831e5aedf87 before 0bf3d168a2cc20b120d6b50f0a8ac5b40ff4d589CVE List
  • Linuxaffected: 682696605c7093d2800c498c04166831e5aedf87 before 1d6e7315ee1c992b4ca42c9b11c5ed0e925a00e0CVE List
  • Linuxaffected: 682696605c7093d2800c498c04166831e5aedf87 before 4553b5004eca9c9eae29a421f1a9c4d5db2c9114CVE List
  • Linuxaffected: 682696605c7093d2800c498c04166831e5aedf87 before 2a863458828ade0671c2bc2e469bbd7f2340eb03CVE List
  • Linuxaffected: 682696605c7093d2800c498c04166831e5aedf87 before 6feadbecdae60a6324c967f3b1493741083793a3CVE List
  • Linuxaffected: 4.13CVE List
  • Linuxunaffected: all versions before 4.13CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 6