All vulnerabilities
CVE-2026-99035

Linux: mmc: mtk-sd: Cancel request timeout work on remove

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in9e799f25c420e759641eb25102967ea091fc758fAlso 46e75703ca3f00fb8c935b3ce35b90836e34e8afCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 9e799f25c420e759641eb25102967ea091fc758fLinuxCVE List
  • 46e75703ca3f00fb8c935b3ce35b90836e34e8afLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

mmc: mtk-sd: Cancel request timeout work on remove

The driver queues req_timeout while a request is active. msdc_request_done() uses cancel_delayed_work(), which does not wait for a timeout callback that has already started.

The timeout callback calls mmc_request_done(), which wakes the request waiter, and then continues to use host->dev_comp and check the SDIO IRQ. During unbind, msdc_drv_remove() can return and the managed mmc_host can be freed before the callback finishes.

KASAN reported use-after-free accesses in msdc_request_done() and msdc_recheck_sdio_irq() in each of three unbind tests. The same tests completed without a kernel diagnostic after this change.

Call cancel_delayed_work_sync() after mmc_remove_host() has stopped new requests and before the driver releases the host resources.

Text from CVE List

Affected versions 12

  • Linuxaffected: 208489032bdd8d4a7de50f3057c175058f271956 before 9e799f25c420e759641eb25102967ea091fc758fCVE List
  • Linuxaffected: 208489032bdd8d4a7de50f3057c175058f271956 before f37e0367ad6f2147a0b37564b442b7a25bec0d23CVE List
  • Linuxaffected: 208489032bdd8d4a7de50f3057c175058f271956 before 46e75703ca3f00fb8c935b3ce35b90836e34e8afCVE List
  • Linuxaffected: 208489032bdd8d4a7de50f3057c175058f271956 before edef1355224c0799a502a46b71d3649fa0dd218eCVE List
  • Linuxaffected: 208489032bdd8d4a7de50f3057c175058f271956 before b38af5386a74416e898955443f2e26547b358cb2CVE List
  • Linuxaffected: 4.2CVE List
  • Linuxunaffected: all versions before 4.2CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.11 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5