CVE-2026-99035None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues req_timeout while a request is active. msdc_request_done() uses cancel_delayed_work(), which does …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
In the Linux kernel, the following vulnerability has been resolved:
mmc: mtk-sd: Cancel request timeout work on remove
The driver queues req_timeout while a request is active. msdc_request_done() uses cancel_delayed_work(), which does not wait for a timeout callback that has already started.
The timeout callback calls mmc_request_done(), which wakes the request waiter, and then continues to use host->dev_comp and check the SDIO IRQ. During unbind, msdc_drv_remove() can return and the managed mmc_host can be freed before the callback finishes.
KASAN reported use-after-free accesses in msdc_request_done() and msdc_recheck_sdio_irq() in each of three unbind tests. The same tests completed without a kernel diagnostic after this change.
Call cancel_delayed_work_sync() after mmc_remove_host() has stopped new requests and before the driver releases the host resources.
Linux >= 208489032bdd8d4a7de50f3057c175058f271956 < 9e799f25c420e759641eb25102967ea091fc758fLinux >= 208489032bdd8d4a7de50f3057c175058f271956 < f37e0367ad6f2147a0b37564b442b7a25bec0d23Linux >= 208489032bdd8d4a7de50f3057c175058f271956 < 46e75703ca3f00fb8c935b3ce35b90836e34e8afLinux >= 208489032bdd8d4a7de50f3057c175058f271956 < edef1355224c0799a502a46b71d3649fa0dd218eLinux >= 208489032bdd8d4a7de50f3057c175058f271956 < b38af5386a74416e898955443f2e26547b358cb2Linux 4.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-38564High· 7.8bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
CVE-2026-99092Noneriscv: patch: fix handling of bpf-jit execmem addresses
CVE-2026-99089NoneASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
CVE-2026-99093Nonemm: don't schedule deferred kernel page table freeing while booting
CVE-2026-99088Nonenet: openvswitch: validate transport header presence in set_ipv6_addr
CVE-2026-99090Nonedrm/amdgpu: serialize vblank counter reads against GPU reset