CVE-2026-98209mmc: sdhci-of-aspeed: Remove children before releasing SDC resources
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-of-aspeed: Remove children before releasing SDC resources Probe failure and removal leave SDHCI child devices registered after the parent clock and managed resources are released. Unregister the OF children in reverse order before disabling the parent clock on both paths. Use of_platform_device_destroy() because manual child creation does not set the flag required by of_platform_depopulate(). This issue was identified during our ongoing static-analysis research while reviewing kernel code.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 6, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c before 6b22b4d29e4fc1d2de2e4d7174925d68220165fb; from bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c before 67e8117df8547433989a6ac1545a68848d0a289f; from bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c before bc5e79a5a5651588f3a93bef7815e4e86f78962c; from bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c before b84d29f2541c8adb768e468388dbaa4bc25ef157; from bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c before 7eb896617a6db846b18596c10ca9f8900a73013e; from bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c before 15b5ffd8af2dd46856da57467eb6e0f90d8ada51; from bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c before 356b4b3b28a8ecd2a6c66d3b9666686315337df1; from bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c before 4396d70bb7fec531bcf934fed016b2f3300c670b | CNA record |
References
- https://git.kernel.org/stable/c/6b22b4d29e4fc1d2de2e4d7174925d68220165fb
- https://git.kernel.org/stable/c/67e8117df8547433989a6ac1545a68848d0a289f
- https://git.kernel.org/stable/c/bc5e79a5a5651588f3a93bef7815e4e86f78962c
- https://git.kernel.org/stable/c/b84d29f2541c8adb768e468388dbaa4bc25ef157
- https://git.kernel.org/stable/c/7eb896617a6db846b18596c10ca9f8900a73013e
- https://git.kernel.org/stable/c/15b5ffd8af2dd46856da57467eb6e0f90d8ada51
- https://git.kernel.org/stable/c/356b4b3b28a8ecd2a6c66d3b9666686315337df1
- https://git.kernel.org/stable/c/4396d70bb7fec531bcf934fed016b2f3300c670b
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.