CVE-2026-98884: mmc: core: Add validation for host-provided max_segs
In the Linux kernel, the following vulnerability has been resolved:
mmc: core: Add validation for host-provided maxsegs
The maxsegs field is of type unsigned short, and if a host driver sets an excessively large value, it may be truncated to zero. This can cause mmcallocsg() to call kmallocobjs() with a zero size allocation request, which leads to undefined behavior.
Under the SLUB allocator, kmalloc(0) returns a special pointer (ZEROSIZEPTR). The subsequent 'if (sg)' check will evaluate to true, and sginittable() will then attempt to access invalid memory, resulting in a crash:
dwmmcrockchip 2a310000.mmc: Successfully tuned phase to 133 mmc1: new UHS-I speed SDR104 SDHC card at address aaaa Unable to handle kernel paging request at virtual address 0000001ffffffff0 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000102c88000 [0000001ffffffff0] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 2 UID: 0 PID: 102 Comm: kworker/2:1 Not tainted 7.0.0-rc6-next-20260331-00013-g4d93c25963c5-dirty #80 PREEMPT Hardware name: Rockchip RK3576 EVB V10 Board (DT) Workqueue: eventsfreezable mmcrescan pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : sginittable+0x2c/0x50 lr : sginittable+0x24/0x50 sp : ffff8000837db710 x29: ffff8000837db710 x28: 000000000000c000 x27: 0000000000000300 x26: 0000000000000000 x25: 0000000000000040 x24: ffff0000c46a0000 x23: 0000000000000000 x22: ffff0000c0c73c00 x21: 0000000000000010 x20: 0000000000000010 x19: 0000000000000000 x18: 000000000000002c x17: 0000000000000000 x16: 0000000000000001 x15: 0000000000000000 x14: 0000000000000400 x13: ffff8000837dc000 x12: 0000000000000000 x11: ffff0000c0c73ca0 x10: 0000000000000040 x9 : 459ec1f0abbdbb00 x8 : 0000001fffffffe0 x7 : 0000000000000000 x6 : 000000000000003f x5 : 0000000000035579 x4 : 0000000000000901 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000010 Call trace: sginittable+0x2c/0x50 (P) mmcmqinitrequest+0x64/0x90 blkmqallocmapandrqs+0x3ac/0x480 blkmqallocsetmapandrqs+0x98/0x1e0 blkmqalloctagset+0x1c0/0x290 mmcinitqueue+0x120/0x370 mmcblkallocreq+0x150/0x420
To prevent this, add a validation check in mmcmqinitrequest() to detect when sglen (derived from maxsegs) is zero. If sglen is zero, we return an error and print an error message, allowing host driver developers to identify and fix incorrect maxsegs configuration.
This is a defensive measure that ensures the MMC core fails gracefully when host drivers provide invalid maxsegs values, rather than crashing with a page fault.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Add a validation check in mmc_mq_init_request() to detect when sg_len, derived from the host-provided max_segs value, is zero; return an error and print an error message instead of allowing mmc_alloc_sg() and sg_init_table() to process the invalid allocation.