---
id: CVE-2026-99035
title: 'mmc: mtk-sd: Cancel request timeout work on remove'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mmc: mtk-sd: Cancel request timeout work on remove

  The driver queues req_timeout while a request is active.
  msdc_request_done() uses cancel_delayed_work(), which does …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 208489032bdd8d4a7de50f3057c175058f271956 <
    9e799f25c420e759641eb25102967ea091fc758f
  - >-
    Linux >= 208489032bdd8d4a7de50f3057c175058f271956 <
    f37e0367ad6f2147a0b37564b442b7a25bec0d23
  - >-
    Linux >= 208489032bdd8d4a7de50f3057c175058f271956 <
    46e75703ca3f00fb8c935b3ce35b90836e34e8af
  - >-
    Linux >= 208489032bdd8d4a7de50f3057c175058f271956 <
    edef1355224c0799a502a46b71d3649fa0dd218e
  - >-
    Linux >= 208489032bdd8d4a7de50f3057c175058f271956 <
    b38af5386a74416e898955443f2e26547b358cb2
  - Linux 4.2
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:21:44.522Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99035'
references:
  - url: 'https://git.kernel.org/stable/c/9e799f25c420e759641eb25102967ea091fc758f'
  - url: 'https://git.kernel.org/stable/c/f37e0367ad6f2147a0b37564b442b7a25bec0d23'
  - url: 'https://git.kernel.org/stable/c/46e75703ca3f00fb8c935b3ce35b90836e34e8af'
  - url: 'https://git.kernel.org/stable/c/edef1355224c0799a502a46b71d3649fa0dd218e'
  - url: 'https://git.kernel.org/stable/c/b38af5386a74416e898955443f2e26547b358cb2'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.531Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mmc: mtk-sd: Cancel request timeout work on remove

The driver queues req_timeout while a request is active.
msdc_request_done() uses cancel_delayed_work(), which does not wait for
a timeout callback that has already started.

The timeout callback calls mmc_request_done(), which wakes the request
waiter, and then continues to use host->dev_comp and check the SDIO IRQ.
During unbind, msdc_drv_remove() can return and the managed mmc_host can
be freed before the callback finishes.

KASAN reported use-after-free accesses in msdc_request_done() and
msdc_recheck_sdio_irq() in each of three unbind tests.  The same tests
completed without a kernel diagnostic after this change.

Call cancel_delayed_work_sync() after mmc_remove_host() has stopped new
requests and before the driver releases the host resources.

## Affected

- `Linux >= 208489032bdd8d4a7de50f3057c175058f271956 < 9e799f25c420e759641eb25102967ea091fc758f`
- `Linux >= 208489032bdd8d4a7de50f3057c175058f271956 < f37e0367ad6f2147a0b37564b442b7a25bec0d23`
- `Linux >= 208489032bdd8d4a7de50f3057c175058f271956 < 46e75703ca3f00fb8c935b3ce35b90836e34e8af`
- `Linux >= 208489032bdd8d4a7de50f3057c175058f271956 < edef1355224c0799a502a46b71d3649fa0dd218e`
- `Linux >= 208489032bdd8d4a7de50f3057c175058f271956 < b38af5386a74416e898955443f2e26547b358cb2`
- `Linux 4.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.