CVE-2026-98213mmc: core: Cancel SDIO IRQ work before freeing host
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: mmc: core: Cancel SDIO IRQ work before freeing host A host controller that uses sdio_signal_irq() schedules host->sdio_irq_work from its interrupt handler. That work is only cancelled on the suspend path (mmc_sdio_suspend()), not on the remove/free path, so a worker armed just before the controller freed its IRQ can run after mmc_host_classdev_release() has freed the host and dereference it through container_of(). Cancel host->sdio_irq_work in mmc_free_host(), like the existing host->detect drain added by commit 1036f69e2513 ("mmc: core: Cancel delayed work before releasing host"). This issue was found by an in-house static analysis tool.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 6, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 682696605c7093d2800c498c04166831e5aedf87 before bae1cf4f9902b2065bd78b759c7fe6312855f05e; 682696605c7093d2800c498c04166831e5aedf87 builds before 0bf3d168a2cc20b120d6b50f0a8ac5b40ff4d589; 682696605c7093d2800c498c04166831e5aedf87 builds before 1d6e7315ee1c992b4ca42c9b11c5ed0e925a00e0; 682696605c7093d2800c498c04166831e5aedf87 builds before 4553b5004eca9c9eae29a421f1a9c4d5db2c9114; 682696605c7093d2800c498c04166831e5aedf87 builds before 2a863458828ade0671c2bc2e469bbd7f2340eb03; 682696605c7093d2800c498c04166831e5aedf87 builds before 6feadbecdae60a6324c967f3b1493741083793a3 | CNA record |
References
- https://git.kernel.org/stable/c/bae1cf4f9902b2065bd78b759c7fe6312855f05e
- https://git.kernel.org/stable/c/0bf3d168a2cc20b120d6b50f0a8ac5b40ff4d589
- https://git.kernel.org/stable/c/1d6e7315ee1c992b4ca42c9b11c5ed0e925a00e0
- https://git.kernel.org/stable/c/4553b5004eca9c9eae29a421f1a9c4d5db2c9114
- https://git.kernel.org/stable/c/2a863458828ade0671c2bc2e469bbd7f2340eb03
- https://git.kernel.org/stable/c/6feadbecdae60a6324c967f3b1493741083793a3
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.