CVE-2026-97502

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97502", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T16:01:01.151Z", "datePublished": "2026-09-24T16:04:49.056Z", "dateUpdated": "2026-10-03T10:59:02.767Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-03T10:59:02.767Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: davinci: avoid NULL deref of host->data in IRQ handler\n\nmmc_davinci_irq() returns early only when both host->cmd and\nhost->data are NULL:\n\n if (host->cmd == NULL && host->data == NULL) {\n ...\n return IRQ_NONE;\n }\n\nSo we may legitimately reach the rest of the handler with\nhost->data == NULL (and therefore data == NULL). The DATDNE branch\nalready guards against this with an explicit \"if (data != NULL)\"\ncheck, but the subsequent TOUTRD (\"read data timeout\") and\nCRCWR/CRCRD (\"data CRC error\") branches dereference data\nunconditionally:\n\n if (qstatus & MMCST0_TOUTRD) {\n data->error = -ETIMEDOUT; <-- NULL deref\n ...\n davinci_abort_data(host, data);\n }\n\n if (qstatus & (MMCST0_CRCWR | MMCST0_CRCRD)) {\n data->error = -EILSEQ; <-- NULL deref\n ...\n }\n\nIf either bit is set in qstatus while host->data is NULL, the kernel\nwill crash inside the IRQ handler. smatch flags this:\n\n drivers/mmc/host/davinci_mmc.c:933 mmc_davinci_irq() error: we\n previously assumed 'data' could be null (see line 914)\n\nGate both branches on a non-NULL data, matching the existing pattern\nused by the DATDNE branch.\n\nNo functional change for callers where data is non-NULL, which is\nthe only case in which these branches did meaningful work before\nthis change."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/mmc/host/davinci_mmc.c"], "versions": [{"version": "b4cff4549b7a8c5fc8b88e3493b6287555f0512c", "lessThan": "51738de7dd5f8e8b33dfc07ef85bc06d3bf41e96", "status": "affected", "versionType": "git"}, {"version": "b4cff4549b7a8c5fc8b88e3493b6287555f0512c", "lessThan": "f216cf00e829895ff49bdf695c944915e59bd698", "status": "affected", "versionType": "git"}, {"version": "b4cff4549b7a8c5fc8b88e3493b6287555f0512c", "lessThan": "a0cde8d70d64c1a75fbd57f01d9f2d7cccac8319", "status": "affected", "versionType": "git"}, {"version": "b4cff4549b7a8c5fc8b88e3493b6287555f0512c", "lessThan": "3c5e3e5badbf0592332887d12db02458323682c3", "status": "affected", "versionType": "git"}, {"version": "b4cff4549b7a8c5fc8b88e3493b6287555f0512c", "lessThan": "a01cedf230dc0fcd55b994f5e548d3982ba4c732", "status": "affected", "versionType": "git"}, {"version": "b4cff4549b7a8c5fc8b88e3493b6287555f0512c", "lessThan": "5b7e151fe9ea9311ba601849aaecdc4fc97fd577", "status": "affected", "versionType": "git"}, {"version": "b4cff4549b7a8c5fc8b88e3493b6287555f0512c", "lessThan": "4f28846aaf8db9668e338b8987973f8935edff34", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/mmc/host/davinci_mmc.c"], "versions": [{"version": "2.6.33", "status": "affected"}, {"version": "0", "lessThan": "2.6.33", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.33", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.33", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.33", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.33", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.33", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.33", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.33", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/51738de7dd5f8e8b33dfc07ef85bc06d3bf41e96"}, {"url": "https://git.kernel.org/stable/c/f216cf00e829895ff49bdf695c944915e59bd698"}, {"url": "https://git.kernel.org/stable/c/a0cde8d70d64c1a75fbd57f01d9f2d7cccac8319"}, {"url": "https://git.kernel.org/stable/c/3c5e3e5badbf0592332887d12db02458323682c3"}, {"url": "https://git.kernel.org/stable/c/a01cedf230dc0fcd55b994f5e548d3982ba4c732"}, {"url": "https://git.kernel.org/stable/c/5b7e151fe9ea9311ba601849aaecdc4fc97fd577"}, {"url": "https://git.kernel.org/stable/c/4f28846aaf8db9668e338b8987973f8935edff34"}], "title": "mmc: davinci: avoid NULL deref of host->data in IRQ handler", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/mmc/host/davinci_mmc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "51738de7dd5f8e8b33dfc07ef85bc06d3bf41e96", "status": "affected", "version": "b4cff4549b7a8c5fc8b88e3493b6287555f0512c", "versionType": "git"}, {"lessThan": "f216cf00e829895ff49bdf695c944915e59bd698", "status": "affected", "version": "b4cff4549b7a8c5fc8b88e3493b6287555f0512c", "versionType": "git"}, {"lessThan": "a0cde8d70d64c1a75fbd57f01d9f2d7cccac8319", "status": "affected", "version": "b4cff4549b7a8c5fc8b88e3493b6287555f0512c", "versionType": "git"}, {"lessThan": "3c5e3e5badbf0592332887d12db02458323682c3", "status": "affected", "version": "b4cff4549b7a8c5fc8b88e3493b6287555f0512c", "versionType": "git"}, {"lessThan": "a01cedf230dc0fcd55b994f5e548d3982ba4c732", "status": "affected", "version": "b4cff4549b7a8c5fc8b88e3493b6287555f0512c", "versionType": "git"}, {"lessThan": "5b7e151fe9ea9311ba601849aaecdc4fc97fd577", "status": "affected", "version": "b4cff4549b7a8c5fc8b88e3493b6287555f0512c", "versionType": "git"}, {"lessThan": "4f28846aaf8db9668e338b8987973f8935edff34", "status": "affected", "version": "b4cff4549b7a8c5fc8b88e3493b6287555f0512c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/mmc/host/davinci_mmc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.33"}, {"lessThan": "2.6.33", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: davinci: avoid NULL deref of host->data in IRQ handler\n\nmmc_davinci_irq() returns early only when both host->cmd and\nhost->data are NULL:\n\n if (host->cmd == NULL && host->data == NULL) {\n ...\n return IRQ_NONE;\n }\n\nSo we may legitimately reach the rest of the handler with\nhost->data == NULL (and therefore data == NULL). The DATDNE branch\nalready guards against this with an explicit \"if (data != NULL)\"\ncheck, but the subsequent TOUTRD (\"read data timeout\") and\nCRCWR/CRCRD (\"data CRC error\") branches dereference data\nunconditionally:\n\n if (qstatus & MMCST0_TOUTRD) {\n data->error = -ETIMEDOUT; <-- NULL deref\n ...\n davinci_abort_data(host, data);\n }\n\n if (qstatus & (MMCST0_CRCWR | MMCST0_CRCRD)) {\n data->error = -EILSEQ; <-- NULL deref\n ...\n }\n\nIf either bit is set in qstatus while host->data is NULL, the kernel\nwill crash inside the IRQ handler. smatch flags this:\n\n drivers/mmc/host/davinci_mmc.c:933 mmc_davinci_irq() error: we\n previously assumed 'data' could be null (see line 914)\n\nGate both branches on a non-NULL data, matching the existing pattern\nused by the DATDNE branch.\n\nNo functional change for callers where data is non-NULL, which is\nthe only case in which these branches did meaningful work before\nthis change."}], "id": "CVE-2026-97502", "lastModified": "2026-10-03T11:17:59.840", "metrics": {}, "published": "2026-09-24T17:17:27.963", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3c5e3e5badbf0592332887d12db02458323682c3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4f28846aaf8db9668e338b8987973f8935edff34"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/51738de7dd5f8e8b33dfc07ef85bc06d3bf41e96"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5b7e151fe9ea9311ba601849aaecdc4fc97fd577"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a01cedf230dc0fcd55b994f5e548d3982ba4c732"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a0cde8d70d64c1a75fbd57f01d9f2d7cccac8319"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f216cf00e829895ff49bdf695c944915e59bd698"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: mmc: davinci: avoid NULL deref of host->data in IRQ handler", "id": "2540397", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540397"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmmc: davinci: avoid NULL deref of host->data in IRQ handler\nmmc_davinci_irq() returns early only when both host->cmd and\nhost->data are NULL:\nif (host->cmd == NULL && host->data == NULL) {\n...\nreturn IRQ_NONE;\n}\nSo we may legitimately reach the rest of the handler with\nhost->data == NULL (and therefore data == NULL). The DATDNE branch\nalready guards against this with an explicit \"if (data != NULL)\"\ncheck, but the subsequent TOUTRD (\"read data timeout\") and\nCRCWR/CRCRD (\"data CRC error\") branches dereference data\nunconditionally:\nif (qstatus & MMCST0_TOUTRD) {\ndata->error = -ETIMEDOUT; <-- NULL deref\n...\ndavinci_abort_data(host, data);\n}\nif (qstatus & (MMCST0_CRCWR | MMCST0_CRCRD)) {\ndata->error = -EILSEQ; <-- NULL deref\n...\n}\nIf either bit is set in qstatus while host->data is NULL, the kernel\nwill crash inside the IRQ handler. smatch flags this:\ndrivers/mmc/host/davinci_mmc.c:933 mmc_davinci_irq() error: we\npreviously assumed 'data' could be null (see line 914)\nGate both branches on a non-NULL data, matching the existing pattern\nused by the DATDNE branch.\nNo functional change for callers where data is non-NULL, which is\nthe only case in which these branches did meaningful work before\nthis change.", "A flaw was found in the Linux kernel's DaVinci MultiMediaCard (MMC) driver. When processing hardware interrupt events such as read timeouts or communication errors, the driver accesses a data pointer without verifying that an active transfer structure exists. A local user or abnormal device condition can trigger these error states, causing a NULL pointer dereference that crashes the system and leads to a Denial of Service (DoS)."], "name": "CVE-2026-97502", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97502\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97502\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97502.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a01cedf230dc0fcd55b994f5e548d3982ba4c732)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,5b7e151fe9ea9311ba601849aaecdc4fc97fd577)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4f28846aaf8db9668e338b8987973f8935edff34)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.12.111)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.53)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T00:45:17.127591+00:00", "updated": "2026-10-01T12:00:06.857594+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}