CVE-2026-98211: mmc: mmci: Fix use-after-free in busy-timeout work
In the Linux kernel, the following vulnerability has been resolved:
mmc: mmci: Fix use-after-free in busy-timeout work
ux500busycomplete() can queue ux500busytimeoutwork for an R1b command, but mmciremove() never cancels it. The work can subsequently dereference the devm-allocated mmcihost after it has been released.
Mask the controller interrupts and disable the delayed work during removal. This drains any queued instance and stops an IRQ handler that is still in progress from queueing the work again once it has been disabled.
This issue was found by an in-house static analysis tool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
During mmci controller removal, mask the controller interrupts and disable the delayed busy-timeout work so any queued work is drained and an in-progress IRQ handler cannot queue it again.
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Systems using the Linux kernel's mmci driver for a UX500 controller are relevant. The vulnerable path involves handling an R1b command that can queue the busy-timeout work.
What condition triggers the use-after-free?
The condition requires busy-timeout work to be queued and the MMCI device to be removed before that work runs. The queued work can then access the devm-allocated mmci_host after it has been released.
What does the resolved fix do during device removal?
It masks controller interrupts and disables the delayed busy-timeout work. This drains queued work and prevents an in-progress IRQ handler from queueing it again after it has been disabled.