CVE-2026-98213

mmc: core: Cancel SDIO IRQ work before freeing host

State: Published
Severity: Not scored
Published: Oct 6, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

mmc: core: Cancel SDIO IRQ work before freeing host

A host controller that uses sdio_signal_irq() schedules host->sdio_irq_work from its interrupt handler. That work is only cancelled on the suspend path (mmc_sdio_suspend()), not on the remove/free path, so a worker armed just before the controller freed its IRQ can run after mmc_host_classdev_release() has freed the host and dereference it through container_of().

Cancel host->sdio_irq_work in mmc_free_host(), like the existing host->detect drain added by commit 1036f69e2513 ("mmc: core: Cancel delayed work before releasing host").

This issue was found by an in-house static analysis tool.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	682696605c7093d2800c498c04166831e5aedf87 to before bae1cf4f9902b2065bd78b759c7fe6312855f05eAffected 682696605c7093d2800c498c04166831e5aedf87 to before 0bf3d168a2cc20b120d6b50f0a8ac5b40ff4d589Affected 682696605c7093d2800c498c04166831e5aedf87 to before 1d6e7315ee1c992b4ca42c9b11c5ed0e925a00e0Affected 682696605c7093d2800c498c04166831e5aedf87 to before 4553b5004eca9c9eae29a421f1a9c4d5db2c9114Affected 682696605c7093d2800c498c04166831e5aedf87 to before 2a863458828ade0671c2bc2e469bbd7f2340eb03Affected 682696605c7093d2800c498c04166831e5aedf87 to before 6feadbecdae60a6324c967f3b1493741083793a3Affected
LinuxLinux	4.13Affected before 4.13Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.54 through 6.18.Not affected 7.2.8 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

682696605c7093d2800c498c04166831e5aedf87 to before bae1cf4f9902b2065bd78b759c7fe6312855f05eAffected
682696605c7093d2800c498c04166831e5aedf87 to before 0bf3d168a2cc20b120d6b50f0a8ac5b40ff4d589Affected
682696605c7093d2800c498c04166831e5aedf87 to before 1d6e7315ee1c992b4ca42c9b11c5ed0e925a00e0Affected
682696605c7093d2800c498c04166831e5aedf87 to before 4553b5004eca9c9eae29a421f1a9c4d5db2c9114Affected
682696605c7093d2800c498c04166831e5aedf87 to before 2a863458828ade0671c2bc2e469bbd7f2340eb03Affected
682696605c7093d2800c498c04166831e5aedf87 to before 6feadbecdae60a6324c967f3b1493741083793a3Affected

LinuxLinux

4.13Affected
before 4.13Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.54 through 6.18.*Not affected
7.2.8 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.