UBUNTU-CVE-2026-98212: Use After Free
In the Linux kernel, the following vulnerability has been resolved: mmc: hsq: Fix use-after-free in retry work mmchsqpumprequests() queues retrywork when requestatomic() returns -EBUSY; today sdhci-sprd is the only consumer that implements requestatomic(). The work is embedded in a devm-allocated mmchsq, but is never cancelled during driver removal. Work still pending at unbind can therefore run after the devm allocation has been released and dereference hsq->mmc and hsq->mrq. Use devmworkautocancel() to cancel and drain retrywork before the devm allocation is released. By the time devres cleanup begins, mmcremovehost() has already stopped the host, so no new requests can arm the work. This issue was found by an in-house static analysis tool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Register retry_work with devm_work_autocancel() so it is cancelled and drained before the devm-allocated mmc_hsq is released during driver removal.
Event History
Frequently Asked Questions
Which systems are most likely exposed to this issue?
The affected software list includes Ubuntu kernel packages for linux, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-gke, linux-riscv, and linux-gkeop. The described retry path is implemented by sdhci-sprd, identified as the only current consumer of request_atomic().
What condition is required for the use-after-free to occur?
A retry_work item must remain pending when the relevant driver is removed or unbound. After the devm-allocated mmc_hsq is released, that pending work can run and dereference freed hsq->mmc and hsq->mrq data.
What does the resolution change to prevent the issue?
The fix uses devm_work_autocancel() to cancel and drain retry_work before the devm allocation is released. The description notes that mmc_remove_host() has already stopped the host before devres cleanup, preventing new requests from queuing the work during cleanup.