CVE-2026-99035 - Vulnerability Details

- mmc: mtk-sd: Cancel request timeout work on remove

Description

In the Linux kernel, the following vulnerability has been resolved:

mmc: mtk-sd: Cancel request timeout work on remove

The driver queues req_timeout while a request is active.
msdc_request_done() uses cancel_delayed_work(), which does not wait for
a timeout callback that has already started.

The timeout callback calls mmc_request_done(), which wakes the request
waiter, and then continues to use host->dev_comp and check the SDIO IRQ.
During unbind, msdc_drv_remove() can return and the managed mmc_host can
be freed before the callback finishes.

KASAN reported use-after-free accesses in msdc_request_done() and
msdc_recheck_sdio_irq() in each of three unbind tests. The same tests
completed without a kernel diagnostic after this change.

Call cancel_delayed_work_sync() after mmc_remove_host() has stopped new
requests and before the driver releases the host resources.

Published: 2026-10-23

Score: 4.1 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel, the mtk-sd MMC driver queues a request‑timeout work item while a request is active. The timeout callback calls msdc_request_done, which wakes the request waiter and continues to reference host->dev_comp and checks the SDIO IRQ. When the driver is unbound, the host can be freed before that callback completes. KASAN reports show use‑after‑free accesses in msdc_request_done and msdc_recheck_sdio_irq. The callback can finish after the host memory is freed, potentially causing a kernel crash or system reboot. This represents a kernel use‑after‑free that can lead to denial of service; it does not provide an obvious remote code execution path.

Affected Systems

Linux kernels that contain the unmodified mtk-sd MMC driver are affected. The problem exists in any kernel build that ships the driver unchanged; no specific version range is documented. Systems that load this driver for MediaTek SDIO devices are potentially impacted.

Risk and Exploitability

EPSS score is < 1% and the CVE is not listed in CISA KEV. The kernel use‑after‑free can result in a crash, indicating a high impact. The likely attack vector is a local privileged user or process that can force the device to be removed or unbound while a request is pending. Because the exploit would trigger a kernel panic rather than code execution, the risk is significant even without a publicly available exploit.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`208489032bdd8d4a7de50f3057c175058f271956`	affected	< d8ce81006ee4e42ce2d0bd3a2ab87adc1e24ef11
`208489032bdd8d4a7de50f3057c175058f271956`	affected	< 2cff6a2a912a3464ae1fefb7e0a82393682ccea6
`208489032bdd8d4a7de50f3057c175058f271956`	affected	< e5d82695f2cabca3222b8f6a89ea0e18bafc4c0a
`208489032bdd8d4a7de50f3057c175058f271956`	affected	< 9e799f25c420e759641eb25102967ea091fc758f
`208489032bdd8d4a7de50f3057c175058f271956`	affected	< f37e0367ad6f2147a0b37564b442b7a25bec0d23
`208489032bdd8d4a7de50f3057c175058f271956`	affected	< 46e75703ca3f00fb8c935b3ce35b90836e34e8af
`208489032bdd8d4a7de50f3057c175058f271956`	affected	< edef1355224c0799a502a46b71d3649fa0dd218e
`208489032bdd8d4a7de50f3057c175058f271956`	affected	< b38af5386a74416e898955443f2e26547b358cb2

Linux

affected

Version	Status	Constraints
`4.2`	affected	—
`0`	unaffected	< 4.2
`5.10.273`	unaffected	≤ 5.10.*
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.57`	unaffected	≤ 6.18.*
`7.2.11`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[208489032bdd8d4a7de50f3057c175058f271956,9e799f25c420e759641eb25102967ea091fc758f)`	affected	code_commit	—
`[208489032bdd8d4a7de50f3057c175058f271956,f37e0367ad6f2147a0b37564b442b7a25bec0d23)`	affected	code_commit	—
`[208489032bdd8d4a7de50f3057c175058f271956,46e75703ca3f00fb8c935b3ce35b90836e34e8af)`	affected	code_commit	—
`[208489032bdd8d4a7de50f3057c175058f271956,edef1355224c0799a502a46b71d3649fa0dd218e)`	affected	code_commit	—
`[208489032bdd8d4a7de50f3057c175058f271956,b38af5386a74416e898955443f2e26547b358cb2)`	affected	code_commit	—

Linux

100%

Version	Status	Scheme	Platform
`4.2`	affected	generic	—
`[0,4.2)`	unaffected	generic	—
`[6.6.160,6.7.0)`	unaffected	semver	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.57,6.19.0)`	unaffected	semver	—
`[7.2.11,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[208489032bdd8d4a7de50f3057c175058f271956,9e799f25c420e759641eb25102967ea091fc758f)`	affected	code_commit	—
`[208489032bdd8d4a7de50f3057c175058f271956,f37e0367ad6f2147a0b37564b442b7a25bec0d23)`	affected	code_commit	—
`[208489032bdd8d4a7de50f3057c175058f271956,46e75703ca3f00fb8c935b3ce35b90836e34e8af)`	affected	code_commit	—
`[208489032bdd8d4a7de50f3057c175058f271956,edef1355224c0799a502a46b71d3649fa0dd218e)`	affected	code_commit	—
`[208489032bdd8d4a7de50f3057c175058f271956,b38af5386a74416e898955443f2e26547b358cb2)`	affected	code_commit	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`4.2`	affected	generic	—
`[0,4.2)`	unaffected	generic	—
`[6.6.160,6.7.0)`	unaffected	semver	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.57,6.19.0)`	unaffected	semver	—
`[7.2.11,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the patch from the referenced commits, which replaces cancel_delayed_work with cancel_delayed_work_sync in the removal path.
If you compile the driver yourself, rebuild it so the cancel_delayed_work_sync change is applied.
If an immediate kernel update is not possible, avoid removing or unbinding the MediaTek SDIO device while it may be servicing a request. Rebooting the system when you need to release resources safely helps prevent the timeout callback from running against freed memory.

Generated by OpenCVE AI on October 29, 2026 at 14:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00177.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99035.mbox
https://git.kernel.org/stable/c/2cff6a2a912a3464ae1fefb7e0a82393682ccea6
https://git.kernel.org/stable/c/46e75703ca3f00fb8c935b3ce35b90836e34e8af
https://git.kernel.org/stable/c/9e799f25c420e759641eb25102967ea091fc758f
https://git.kernel.org/stable/c/b38af5386a74416e898955443f2e26547b358cb2
https://git.kernel.org/stable/c/d8ce81006ee4e42ce2d0bd3a2ab87adc1e24ef11
https://git.kernel.org/stable/c/e5d82695f2cabca3222b8f6a89ea0e18bafc4c0a
https://git.kernel.org/stable/c/edef1355224c0799a502a46b71d3649fa0dd218e
https://git.kernel.org/stable/c/f37e0367ad6f2147a0b37564b442b7a25bec0d23
https://nvd.nist.gov/vuln/detail/CVE-2026-99035
https://www.cve.org/CVERecord?id=CVE-2026-99035

History

Fri, 30 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/2cff6a2a912a3464ae1fefb7e0a82393682ccea6 https://git.kernel.org/stable/c/d8ce81006ee4e42ce2d0bd3a2ab87adc1e24ef11 https://git.kernel.org/stable/c/e5d82695f2cabca3222b8f6a89ea0e18bafc4c0a

Thu, 29 Oct 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99035.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-99035 https://www.cve.org/CVERecord?id=CVE-2026-99035
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 23 Oct 2026 20:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 17:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Fri, 23 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues req_timeout while a request is active. msdc_request_done() uses cancel_delayed_work(), which does not wait for a timeout callback that has already started. The timeout callback calls mmc_request_done(), which wakes the request waiter, and then continues to use host->dev_comp and check the SDIO IRQ. During unbind, msdc_drv_remove() can return and the managed mmc_host can be freed before the callback finishes. KASAN reported use-after-free accesses in msdc_request_done() and msdc_recheck_sdio_irq() in each of three unbind tests. The same tests completed without a kernel diagnostic after this change. Call cancel_delayed_work_sync() after mmc_remove_host() has stopped new requests and before the driver releases the host resources.
Title		mmc: mtk-sd: Cancel request timeout work on remove
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/46e75703ca3f00fb8c935b3ce35b90836e34e8af https://git.kernel.org/stable/c/9e799f25c420e759641eb25102967ea091fc758f https://git.kernel.org/stable/c/b38af5386a74416e898955443f2e26547b358cb2 https://git.kernel.org/stable/c/edef1355224c0799a502a46b71d3649fa0dd218e https://git.kernel.org/stable/c/f37e0367ad6f2147a0b37564b442b7a25bec0d23

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T12:21:44.522Z

Updated: 2026-10-30T12:41:08.346Z

Reserved: 2026-09-25T10:25:14.387Z

Link: CVE-2026-99035

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T13:17:26.700

Modified: 2026-10-30T13:21:40.553

Link: CVE-2026-99035

Redhat

Severity : Moderate

Publid Date: 2026-10-23T00:00:00Z

Links: CVE-2026-99035 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-29T15:00:22Z

Weaknesses

CWE-416
Use After Free
CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object