{"id":"CVE-2026-99035","published":"2026-10-23T13:17:26.700","lastModified":"2026-10-23T13:17:26.700","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: mtk-sd: Cancel request timeout work on remove\n\nThe driver queues req_timeout while a request is active.\nmsdc_request_done() uses cancel_delayed_work(), which does not wait for\na timeout callback that has already started.\n\nThe timeout callback calls mmc_request_done(), which wakes the request\nwaiter, and then continues to use host->dev_comp and check the SDIO IRQ.\nDuring unbind, msdc_drv_remove() can return and the managed mmc_host can\nbe freed before the callback finishes.\n\nKASAN reported use-after-free accesses in msdc_request_done() and\nmsdc_recheck_sdio_irq() in each of three unbind tests.  The same tests\ncompleted without a kernel diagnostic after this change.\n\nCall cancel_delayed_work_sync() after mmc_remove_host() has stopped new\nrequests and before the driver releases the host resources.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/46e75703ca3f00fb8c935b3ce35b90836e34e8af","tags":[]},{"url":"https://git.kernel.org/stable/c/9e799f25c420e759641eb25102967ea091fc758f","tags":[]},{"url":"https://git.kernel.org/stable/c/b38af5386a74416e898955443f2e26547b358cb2","tags":[]},{"url":"https://git.kernel.org/stable/c/edef1355224c0799a502a46b71d3649fa0dd218e","tags":[]},{"url":"https://git.kernel.org/stable/c/f37e0367ad6f2147a0b37564b442b7a25bec0d23","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}