CVE-2026-99035
Received
Received - Intake
Use-After-Free in Linux Kernel mmc Host Driver
Vulnerability report for CVE-2026-99035, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-23
Last updated on: 2026-10-23
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
mmc: mtk-sd: Cancel request timeout work on remove
The driver queues req_timeout while a request is active.
msdc_request_done() uses cancel_delayed_work(), which does not wait for
a timeout callback that has already started.
The timeout callback calls mmc_request_done(), which wakes the request
waiter, and then continues to use host->dev_comp and check the SDIO IRQ.
During unbind, msdc_drv_remove() can return and the managed mmc_host can
be freed before the callback finishes.
KASAN reported use-after-free accesses in msdc_request_done() and
msdc_recheck_sdio_irq() in each of three unbind tests. The same tests
completed without a kernel diagnostic after this change.
Call cancel_delayed_work_sync() after mmc_remove_host() has stopped new
requests and before the driver releases the host resources.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | 208489032bdd8d4a7de50f3057c175058f271956 |
| Linux | Linux | 208489032bdd8d4a7de50f3057c175058f271956 |
| Linux | Linux | 208489032bdd8d4a7de50f3057c175058f271956 |
| Linux | Linux | 208489032bdd8d4a7de50f3057c175058f271956 |
| Linux | Linux | 208489032bdd8d4a7de50f3057c175058f271956 |
| Linux | Linux | 4.2 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
