Strix
73.2K

CVE-2026-99035

UnknownEPSS 0.17%

Last modified

CVE-2026-99035 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues req_timeout while a request is active. msdc_request_done() uses cancel_delayed_work(), which does not wait for a timeout callback that has already started. The timeout callback calls mmc_request_done(), which wakes the request waiter, and then continues to use host->dev_comp and check the SDIO IRQ. During unbind, msdc_drv_remove() can return and the managed mmc_host can be freed before the callback finishes. KASAN reported use-after-free accesses in msdc_request_done() and msdc_recheck_sdio_irq() in each of three unbind tests. The same tests completed without a kernel diagnostic after this change. Call cancel_delayed_work_sync() after mmc_remove_host() has stopped new requests and before the driver releases the host resources.. EPSS estimates a 0.17% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues req_timeout while a request is active. msdc_request_done() uses cancel_delayed_work(), which does not wait for a timeout callback that has already started. The timeout callback calls mmc_request_done(), which wakes the request waiter, and then continues to use host->dev_comp and check the SDIO IRQ. During unbind, msdc_drv_remove() can return and the managed mmc_host can be freed before the callback finishes. KASAN reported use-after-free accesses in msdc_request_done() and msdc_recheck_sdio_irq() in each of three unbind tests. The same tests completed without a kernel diagnostic after this change. Call cancel_delayed_work_sync() after mmc_remove_host() has stopped new requests and before the driver releases the host resources.

Metrics

EPSS Probability
0.17%

6.1th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 208489032bdd8d4a7de50f3057c175058f271956, < d8ce81006ee4e42ce2d0bd3a2ab87adc1e24ef11; >= 208489032bdd8d4a7de50f3057c175058f271956, < 2cff6a2a912a3464ae1fefb7e0a82393682ccea6; >= 208489032bdd8d4a7de50f3057c175058f271956, < e5d82695f2cabca3222b8f6a89ea0e18bafc4c0a; >= 208489032bdd8d4a7de50f3057c175058f271956, < 9e799f25c420e759641eb25102967ea091fc758f; >= 208489032bdd8d4a7de50f3057c175058f271956, < f37e0367ad6f2147a0b37564b442b7a25bec0d23; >= 208489032bdd8d4a7de50f3057c175058f271956, < 46e75703ca3f00fb8c935b3ce35b90836e34e8af; >= 208489032bdd8d4a7de50f3057c175058f271956, < edef1355224c0799a502a46b71d3649fa0dd218e; >= 208489032bdd8d4a7de50f3057c175058f271956, < b38af5386a74416e898955443f2e26547b358cb2
LinuxLinux4.2

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-99035?
In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues req_timeout while a request is active. msdc_request_done() uses cancel_delayed_work(), which does not wait for a timeout callback that has already started. The timeout callback calls mmc_request_done(), which wakes the request waiter, and then continues to use host->dev_comp and check the SDIO IRQ. During unbind, msdc_drv_remove() can return and the managed mmc_host can be freed before the callback finishes. KASAN reported use-after-free accesses in msdc_request_done() and msdc_recheck_sdio_irq() in each of three unbind tests. The same tests completed without a kernel diagnostic after this change. Call cancel_delayed_work_sync() after mmc_remove_host() has stopped new requests and before the driver releases the host resources.
How severe is CVE-2026-99035?
Severity scoring for CVE-2026-99035 is pending analysis. The EPSS model estimates a 0.17% probability of exploitation in the next 30 days.
How do I fix CVE-2026-99035?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-99035?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST