UBUNTU-CVE-2026-98213: Low severity ubuntu/linux-azure vulnerability
In the Linux kernel, the following vulnerability has been resolved: mmc: core: Cancel SDIO IRQ work before freeing host A host controller that uses sdiosignalirq() schedules host->sdioirqwork from its interrupt handler. That work is only cancelled on the suspend path (mmcsdiosuspend()), not on the remove/free path, so a worker armed just before the controller freed its IRQ can run after mmchostclassdevrelease() has freed the host and dereference it through containerof(). Cancel host->sdioirqwork in mmcfreehost(), like the existing host->detect drain added by commit 1036f69e2513 ("mmc: core: Cancel delayed work before releasing host"). This issue was found by an in-house static analysis tool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Cancel host->sdio_irq_work in mmc_free_host() before freeing the host, matching the existing host->detect delayed-work drain.
Linux kernel mmc core host->sdio_irq_work = cancelled in mmc_free_host()
Event History
Frequently Asked Questions
Which Ubuntu kernel package families are in scope?
The affected software list includes ubuntu/linux, ubuntu/linux-azure, ubuntu/linux-aws-fips, ubuntu/linux-azure-fips, ubuntu/linux-fips, ubuntu/linux-gcp-fips, ubuntu/linux-gcp, and ubuntu/linux-oracle.
Is suspending the system sufficient to prevent the unsafe work from running?
The SDIO IRQ work is cancelled on the suspend path, but the issue occurs on the remove/free path because that work was not cancelled before the host was released. The resolved change cancels host->sdio_irq_work in mmc_free_host().