CVE-2026-99035

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99035", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.387Z", "datePublished": "2026-10-23T12:21:44.522Z", "dateUpdated": "2026-10-30T12:41:08.346Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:41:08.346Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: mtk-sd: Cancel request timeout work on remove\n\nThe driver queues req_timeout while a request is active.\nmsdc_request_done() uses cancel_delayed_work(), which does not wait for\na timeout callback that has already started.\n\nThe timeout callback calls mmc_request_done(), which wakes the request\nwaiter, and then continues to use host->dev_comp and check the SDIO IRQ.\nDuring unbind, msdc_drv_remove() can return and the managed mmc_host can\nbe freed before the callback finishes.\n\nKASAN reported use-after-free accesses in msdc_request_done() and\nmsdc_recheck_sdio_irq() in each of three unbind tests. The same tests\ncompleted without a kernel diagnostic after this change.\n\nCall cancel_delayed_work_sync() after mmc_remove_host() has stopped new\nrequests and before the driver releases the host resources."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/mmc/host/mtk-sd.c"], "versions": [{"version": "208489032bdd8d4a7de50f3057c175058f271956", "lessThan": "d8ce81006ee4e42ce2d0bd3a2ab87adc1e24ef11", "status": "affected", "versionType": "git"}, {"version": "208489032bdd8d4a7de50f3057c175058f271956", "lessThan": "2cff6a2a912a3464ae1fefb7e0a82393682ccea6", "status": "affected", "versionType": "git"}, {"version": "208489032bdd8d4a7de50f3057c175058f271956", "lessThan": "e5d82695f2cabca3222b8f6a89ea0e18bafc4c0a", "status": "affected", "versionType": "git"}, {"version": "208489032bdd8d4a7de50f3057c175058f271956", "lessThan": "9e799f25c420e759641eb25102967ea091fc758f", "status": "affected", "versionType": "git"}, {"version": "208489032bdd8d4a7de50f3057c175058f271956", "lessThan": "f37e0367ad6f2147a0b37564b442b7a25bec0d23", "status": "affected", "versionType": "git"}, {"version": "208489032bdd8d4a7de50f3057c175058f271956", "lessThan": "46e75703ca3f00fb8c935b3ce35b90836e34e8af", "status": "affected", "versionType": "git"}, {"version": "208489032bdd8d4a7de50f3057c175058f271956", "lessThan": "edef1355224c0799a502a46b71d3649fa0dd218e", "status": "affected", "versionType": "git"}, {"version": "208489032bdd8d4a7de50f3057c175058f271956", "lessThan": "b38af5386a74416e898955443f2e26547b358cb2", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/mmc/host/mtk-sd.c"], "versions": [{"version": "4.2", "status": "affected"}, {"version": "0", "lessThan": "4.2", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d8ce81006ee4e42ce2d0bd3a2ab87adc1e24ef11"}, {"url": "https://git.kernel.org/stable/c/2cff6a2a912a3464ae1fefb7e0a82393682ccea6"}, {"url": "https://git.kernel.org/stable/c/e5d82695f2cabca3222b8f6a89ea0e18bafc4c0a"}, {"url": "https://git.kernel.org/stable/c/9e799f25c420e759641eb25102967ea091fc758f"}, {"url": "https://git.kernel.org/stable/c/f37e0367ad6f2147a0b37564b442b7a25bec0d23"}, {"url": "https://git.kernel.org/stable/c/46e75703ca3f00fb8c935b3ce35b90836e34e8af"}, {"url": "https://git.kernel.org/stable/c/edef1355224c0799a502a46b71d3649fa0dd218e"}, {"url": "https://git.kernel.org/stable/c/b38af5386a74416e898955443f2e26547b358cb2"}], "title": "mmc: mtk-sd: Cancel request timeout work on remove", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/mmc/host/mtk-sd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d8ce81006ee4e42ce2d0bd3a2ab87adc1e24ef11", "status": "affected", "version": "208489032bdd8d4a7de50f3057c175058f271956", "versionType": "git"}, {"lessThan": "2cff6a2a912a3464ae1fefb7e0a82393682ccea6", "status": "affected", "version": "208489032bdd8d4a7de50f3057c175058f271956", "versionType": "git"}, {"lessThan": "e5d82695f2cabca3222b8f6a89ea0e18bafc4c0a", "status": "affected", "version": "208489032bdd8d4a7de50f3057c175058f271956", "versionType": "git"}, {"lessThan": "9e799f25c420e759641eb25102967ea091fc758f", "status": "affected", "version": "208489032bdd8d4a7de50f3057c175058f271956", "versionType": "git"}, {"lessThan": "f37e0367ad6f2147a0b37564b442b7a25bec0d23", "status": "affected", "version": "208489032bdd8d4a7de50f3057c175058f271956", "versionType": "git"}, {"lessThan": "46e75703ca3f00fb8c935b3ce35b90836e34e8af", "status": "affected", "version": "208489032bdd8d4a7de50f3057c175058f271956", "versionType": "git"}, {"lessThan": "edef1355224c0799a502a46b71d3649fa0dd218e", "status": "affected", "version": "208489032bdd8d4a7de50f3057c175058f271956", "versionType": "git"}, {"lessThan": "b38af5386a74416e898955443f2e26547b358cb2", "status": "affected", "version": "208489032bdd8d4a7de50f3057c175058f271956", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/mmc/host/mtk-sd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.2"}, {"lessThan": "4.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: mtk-sd: Cancel request timeout work on remove\n\nThe driver queues req_timeout while a request is active.\nmsdc_request_done() uses cancel_delayed_work(), which does not wait for\na timeout callback that has already started.\n\nThe timeout callback calls mmc_request_done(), which wakes the request\nwaiter, and then continues to use host->dev_comp and check the SDIO IRQ.\nDuring unbind, msdc_drv_remove() can return and the managed mmc_host can\nbe freed before the callback finishes.\n\nKASAN reported use-after-free accesses in msdc_request_done() and\nmsdc_recheck_sdio_irq() in each of three unbind tests. The same tests\ncompleted without a kernel diagnostic after this change.\n\nCall cancel_delayed_work_sync() after mmc_remove_host() has stopped new\nrequests and before the driver releases the host resources."}], "id": "CVE-2026-99035", "lastModified": "2026-10-30T13:21:40.553", "metrics": {}, "published": "2026-10-23T13:17:26.700", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2cff6a2a912a3464ae1fefb7e0a82393682ccea6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/46e75703ca3f00fb8c935b3ce35b90836e34e8af"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9e799f25c420e759641eb25102967ea091fc758f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b38af5386a74416e898955443f2e26547b358cb2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d8ce81006ee4e42ce2d0bd3a2ab87adc1e24ef11"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e5d82695f2cabca3222b8f6a89ea0e18bafc4c0a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/edef1355224c0799a502a46b71d3649fa0dd218e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f37e0367ad6f2147a0b37564b442b7a25bec0d23"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: mmc: mtk-sd: Cancel request timeout work on remove", "id": "2559777", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559777"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmmc: mtk-sd: Cancel request timeout work on remove\nThe driver queues req_timeout while a request is active.\nmsdc_request_done() uses cancel_delayed_work(), which does not wait for\na timeout callback that has already started.\nThe timeout callback calls mmc_request_done(), which wakes the request\nwaiter, and then continues to use host->dev_comp and check the SDIO IRQ.\nDuring unbind, msdc_drv_remove() can return and the managed mmc_host can\nbe freed before the callback finishes.\nKASAN reported use-after-free accesses in msdc_request_done() and\nmsdc_recheck_sdio_irq() in each of three unbind tests. The same tests\ncompleted without a kernel diagnostic after this change.\nCall cancel_delayed_work_sync() after mmc_remove_host() has stopped new\nrequests and before the driver releases the host resources.", "A flaw was found in the MediaTek SD/MMC host controller driver within the Linux kernel. When the driver is removed or unbound, it fails to wait for active request timeout tasks to complete before releasing host memory resources. A local user could exploit this timing issue during device removal to trigger a use-after-free condition, leading to a denial of service (DoS) or kernel memory corruption."], "name": "CVE-2026-99035", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99035\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99035\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99035.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[208489032bdd8d4a7de50f3057c175058f271956,9e799f25c420e759641eb25102967ea091fc758f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[208489032bdd8d4a7de50f3057c175058f271956,f37e0367ad6f2147a0b37564b442b7a25bec0d23)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[208489032bdd8d4a7de50f3057c175058f271956,46e75703ca3f00fb8c935b3ce35b90836e34e8af)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[208489032bdd8d4a7de50f3057c175058f271956,edef1355224c0799a502a46b71d3649fa0dd218e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[208489032bdd8d4a7de50f3057c175058f271956,b38af5386a74416e898955443f2e26547b358cb2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[208489032bdd8d4a7de50f3057c175058f271956,9e799f25c420e759641eb25102967ea091fc758f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[208489032bdd8d4a7de50f3057c175058f271956,f37e0367ad6f2147a0b37564b442b7a25bec0d23)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[208489032bdd8d4a7de50f3057c175058f271956,46e75703ca3f00fb8c935b3ce35b90836e34e8af)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[208489032bdd8d4a7de50f3057c175058f271956,edef1355224c0799a502a46b71d3649fa0dd218e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[208489032bdd8d4a7de50f3057c175058f271956,b38af5386a74416e898955443f2e26547b358cb2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T17:00:15.614775+00:00", "updated": "2026-10-29T15:00:22.073149+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-416", "CWE-825"]}