CVE-2026-98212

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: mmc: hsq: Fix use-after-free in retry work mmc_hsq_pump_requests() queues retry_work when request_atomic() returns -EBUSY; today sdhci-sprd is the only consumer that implements request_atomic(). The work is embedded in a devm-allocated mmc_hsq, but is never cancelled during driver removal. Work still pending at unbind can therefore run after the devm allocation has been released and dereference hsq->mmc and hsq->mrq. Use devm_work_autocancel() to cancel and drain retry_work before the devm allocation is released. By the time devres cleanup begins, mmc_remove_host() has already stopped the host, so no new requests can arm the work. This issue was found by an in-house static analysis tool.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98212

EUVD

EUVD-2026-93140

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	6db96e5810e0a6a345b7d78549de7676ae5b2662
Linux	Linux	6db96e5810e0a6a345b7d78549de7676ae5b2662
Linux	Linux	6db96e5810e0a6a345b7d78549de7676ae5b2662
Linux	Linux	6db96e5810e0a6a345b7d78549de7676ae5b2662
Linux	Linux	6db96e5810e0a6a345b7d78549de7676ae5b2662
Linux	Linux	5.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a use-after-free issue in the Linux kernel's mmc subsystem. It occurs in the hsq (host switch queue) functionality where retry_work is queued when a request fails with -EBUSY. The problem is that retry_work is not cancelled during driver removal, so it can run after the memory allocated for mmc_hsq has been freed, leading to potential crashes or undefined behavior by accessing freed memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's MMC subsystem and involves a use-after-free in the hsq retry work mechanism. Detection requires checking kernel logs for related errors or kernel crashes during driver unloading or MMC operations. No direct network detection commands are applicable.

Impact Analysis

If you are using a Linux system with the affected mmc subsystem (specifically sdhci-sprd driver), this vulnerability could cause system instability or crashes when the driver is unloaded or the device is removed. It may lead to kernel panics or unexpected behavior due to accessing freed memory.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a use-after-free issue in the Linux kernel's MMC subsystem that could lead to system instability or crashes but does not involve data exposure or unauthorized access.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this issue. If using a distribution kernel, apply the vendor's security patch. No immediate manual mitigation steps are required beyond updating the kernel.

Hi! I’m here to help you understand CVE-2026-98212. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70