CVE-2026-97502: mmc: davinci: avoid NULL deref of host->data in IRQ handler
In the Linux kernel, the following vulnerability has been resolved:
mmc: davinci: avoid NULL deref of host->data in IRQ handler
mmcdavinciirq() returns early only when both host->cmd and host->data are NULL:
if (host->cmd == NULL && host->data == NULL) { ... return IRQNONE; }
So we may legitimately reach the rest of the handler with host->data == NULL (and therefore data == NULL). The DATDNE branch already guards against this with an explicit "if (data != NULL)" check, but the subsequent TOUTRD ("read data timeout") and CRCWR/CRCRD ("data CRC error") branches dereference data unconditionally:
if (qstatus & MMCST0TOUTRD) { data->error = -ETIMEDOUT; <-- NULL deref ... davinciabortdata(host, data); }
if (qstatus & (MMCST0CRCWR | MMCST0CRCRD)) { data->error = -EILSEQ; <-- NULL deref ... }
If either bit is set in qstatus while host->data is NULL, the kernel will crash inside the IRQ handler. smatch flags this:
drivers/mmc/host/davincimmc.c:933 mmcdavinciirq() error: we previously assumed 'data' could be null (see line 914)
Gate both branches on a non-NULL data, matching the existing pattern used by the DATDNE branch.
No functional change for callers where data is non-NULL, which is the only case in which these branches did meaningful work before this change.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In mmc_davinci_irq() in drivers/mmc/host/davinci_mmc.c, gate the CRCWR/CRCRD (data CRC error) and TOUTRD (read data timeout) branches on host->data being non-NULL before dereferencing data or calling davinci_abort_data(host, data).
Event History
Frequently Asked Questions
Under what conditions can the kernel crash?
The crash can occur in the DaVinci MMC IRQ handler when host->data is NULL but the interrupt status reports a read-data timeout (TOUTRD) or a data CRC error (CRCWR or CRCRD). Those paths previously dereferenced the absent data structure unconditionally.
Which systems are exposed?
Systems using the Linux kernel's DaVinci MMC host driver are relevant. The provided information does not identify affected kernel versions or state whether the driver is enabled by default.
What does the fix change?
The fix gates the read-timeout and data-CRC-error handling branches on a non-NULL data pointer, consistent with the existing DATDNE handling. Behavior is unchanged when a data request is present.