CVE-2026-98210
Description
In the Linux kernel, the following vulnerability has been resolved: mmc: mxcmmc: cancel data work and watchdog on remove mxcmci_remove() frees the host through the devm tail, but neither it nor mmc_remove_host() drains the driver's own asynchronous state. host->watchdog, a 10 s timer armed on the DMA path in mxcmci_setup_data(), is deleted only by the DMA- and IRQ-complete paths, which the remove path does not explicitly drain; it can therefore fire after the host is freed and dereference it in mxcmci_watchdog(). host->datawork, armed from the IRQ handler on the PIO path, is not cancelled by the remove path either. Free the devm-registered IRQ, then cancel datawork and delete the watchdog in mxcmci_remove(), before dma_release_channel(). Freeing the IRQ first keeps a trailing handler from re-arming datawork between the cancel and the host free. Both callbacks are non-self-rearming. This issue was found by an in-house static analysis tool.
How to fix
- Linux Linux740f595f8ad678cb4d79f13edd12851df2492bdd, d3641afe6ee76d852834a34ef0669eefced32752, 314966b490323bdcfd3162a1398b00e587e0ced4, ae10838a7cdf0e54caa9d0a4f488704fd04e7f01, a1ff367e0dc961d73707add508a95df5c3509bd1, 23383e0578b58ba2dc0730cf9f7806bd66bf859a, e2948c4232209e87c861a680f20f1e3cf8a57fec, d3a421c82412344022982d5b91ba23194a0a6f29 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | f6ad0a481342223b2e7ae9f55b154e14f1391ada ≤ v < 740f595f8ad678cb4d79f13edd12851df2492bdd, f6ad0a481342223b2e7ae9f55b154e14f1391ada ≤ v < d3641afe6ee76d852834a34ef0669eefced32752, f6ad0a481342223b2e7ae9f55b154e14f1391ada ≤ v < 314966b490323bdcfd3162a1398b00e587e0ced4, f6ad0a481342223b2e7ae9f55b154e14f1391ada ≤ v < ae10838a7cdf0e54caa9d0a4f488704fd04e7f01, f6ad0a481342223b2e7ae9f55b154e14f1391ada ≤ v < a1ff367e0dc961d73707add508a95df5c3509bd1, f6ad0a481342223b2e7ae9f55b154e14f1391ada ≤ v < 23383e0578b58ba2dc0730cf9f7806bd66bf859a, f6ad0a481342223b2e7ae9f55b154e14f1391ada ≤ v < e2948c4232209e87c861a680f20f1e3cf8a57fec, f6ad0a481342223b2e7ae9f55b154e14f1391ada ≤ v < d3a421c82412344022982d5b91ba23194a0a6f29, 3.7 | 740f595f8ad678cb4d79f13edd12851df2492bdd, d3641afe6ee76d852834a34ef0669eefced32752, 314966b490323bdcfd3162a1398b00e587e0ced4, ae10838a7cdf0e54caa9d0a4f488704fd04e7f01, a1ff367e0dc961d73707add508a95df5c3509bd1, 23383e0578b58ba2dc0730cf9f7806bd66bf859a, e2948c4232209e87c861a680f20f1e3cf8a57fec, d3a421c82412344022982d5b91ba23194a0a6f29 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.