{"id":"CVE-2026-99035","title":"mmc: mtk-sd: Cancel request timeout work on remove","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: mtk-sd: Cancel request timeout work on remove\n\nThe driver queues req_timeout while a request is active.\nmsdc_request_done() uses cancel_delayed_work(), which does …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 208489032bdd8d4a7de50f3057c175058f271956 < 9e799f25c420e759641eb25102967ea091fc758f","Linux >= 208489032bdd8d4a7de50f3057c175058f271956 < f37e0367ad6f2147a0b37564b442b7a25bec0d23","Linux >= 208489032bdd8d4a7de50f3057c175058f271956 < 46e75703ca3f00fb8c935b3ce35b90836e34e8af","Linux >= 208489032bdd8d4a7de50f3057c175058f271956 < edef1355224c0799a502a46b71d3649fa0dd218e","Linux >= 208489032bdd8d4a7de50f3057c175058f271956 < b38af5386a74416e898955443f2e26547b358cb2","Linux 4.2"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T12:21:44.522Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99035","references":[{"url":"https://git.kernel.org/stable/c/9e799f25c420e759641eb25102967ea091fc758f"},{"url":"https://git.kernel.org/stable/c/f37e0367ad6f2147a0b37564b442b7a25bec0d23"},{"url":"https://git.kernel.org/stable/c/46e75703ca3f00fb8c935b3ce35b90836e34e8af"},{"url":"https://git.kernel.org/stable/c/edef1355224c0799a502a46b71d3649fa0dd218e"},{"url":"https://git.kernel.org/stable/c/b38af5386a74416e898955443f2e26547b358cb2"}],"tags":["cve.org"],"ingestedAt":"2026-10-23T13:24:55.531Z","slug":"CVE-2026-99035","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmmc: mtk-sd: Cancel request timeout work on remove\n\nThe driver queues req_timeout while a request is active.\nmsdc_request_done() uses cancel_delayed_work(), which does not wait for\na timeout callback that has already started.\n\nThe timeout callback calls mmc_request_done(), which wakes the request\nwaiter, and then continues to use host->dev_comp and check the SDIO IRQ.\nDuring unbind, msdc_drv_remove() can return and the managed mmc_host can\nbe freed before the callback finishes.\n\nKASAN reported use-after-free accesses in msdc_request_done() and\nmsdc_recheck_sdio_irq() in each of three unbind tests.  The same tests\ncompleted without a kernel diagnostic after this change.\n\nCall cancel_delayed_work_sync() after mmc_remove_host() has stopped new\nrequests and before the driver releases the host resources.\n\n## Affected\n\n- `Linux >= 208489032bdd8d4a7de50f3057c175058f271956 < 9e799f25c420e759641eb25102967ea091fc758f`\n- `Linux >= 208489032bdd8d4a7de50f3057c175058f271956 < f37e0367ad6f2147a0b37564b442b7a25bec0d23`\n- `Linux >= 208489032bdd8d4a7de50f3057c175058f271956 < 46e75703ca3f00fb8c935b3ce35b90836e34e8af`\n- `Linux >= 208489032bdd8d4a7de50f3057c175058f271956 < edef1355224c0799a502a46b71d3649fa0dd218e`\n- `Linux >= 208489032bdd8d4a7de50f3057c175058f271956 < b38af5386a74416e898955443f2e26547b358cb2`\n- `Linux 4.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}