CVE-2026-98213: mmc: core: Cancel SDIO IRQ work before freeing host
In the Linux kernel, the following vulnerability has been resolved:
mmc: core: Cancel SDIO IRQ work before freeing host
A host controller that uses sdiosignalirq() schedules host->sdioirqwork from its interrupt handler. That work is only cancelled on the suspend path (mmcsdiosuspend()), not on the remove/free path, so a worker armed just before the controller freed its IRQ can run after mmchostclassdevrelease() has freed the host and dereference it through containerof().
Cancel host->sdioirqwork in mmcfreehost(), like the existing host->detect drain added by commit 1036f69e2513 ("mmc: core: Cancel delayed work before releasing host").
This issue was found by an in-house static analysis tool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.189 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.158 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.112 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.54 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.8 - Compensating control
Cancel host->sdio_irq_work in mmc_free_host() before freeing the host, analogous to the existing host->detect delayed-work drain.
Event History
Frequently Asked Questions
Which systems are exposed to this lifetime race?
Systems using an MMC host controller that invokes sdio_signal_irq() are relevant. The vulnerable path requires SDIO IRQ work to be scheduled and the host subsequently removed or freed.
What timing is required for the issue to occur?
An interrupt handler must arm host->sdio_irq_work shortly before the controller's IRQ is freed and the host is released. The queued worker can then run after the host has been freed and dereference the stale host pointer.