CVE-2026-98212: mmc: hsq: Fix use-after-free in retry work
In the Linux kernel, the following vulnerability has been resolved:
mmc: hsq: Fix use-after-free in retry work
mmchsqpumprequests() queues retrywork when requestatomic() returns -EBUSY; today sdhci-sprd is the only consumer that implements requestatomic(). The work is embedded in a devm-allocated mmchsq, but is never cancelled during driver removal. Work still pending at unbind can therefore run after the devm allocation has been released and dereference hsq->mmc and hsq->mrq.
Use devmworkautocancel() to cancel and drain retrywork before the devm allocation is released. By the time devres cleanup begins, mmcremovehost() has already stopped the host, so no new requests can arm the work.
This issue was found by an in-house static analysis tool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Use devm_work_autocancel() for mmc_hsq retry_work so it is cancelled and drained before the devm-allocated mmc_hsq is released during driver removal.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected path requires an MMC host using the Host Software Queue (HSQ) code and a driver that implements request_atomic(). The description identifies sdhci-sprd as the only current consumer implementing request_atomic().
What condition is required to trigger the use-after-free?
A request must cause mmc_hsq_pump_requests() to queue retry_work after request_atomic() returns -EBUSY, and the driver must then be removed or unbound while that work remains pending. The pending work can run after the devm-allocated HSQ structure has been released.
What changes mitigate the issue when applying the fix?
The fix uses devm_work_autocancel() so retry_work is cancelled and drained before the devm allocation is released during driver removal. The host has already been stopped by mmc_remove_host() before devres cleanup, preventing new requests from queuing the work at that stage.