Medium 5.5Published May 13, 2026

CVE-2026-43484mmc: core: Avoid bitfield RMW for claim/retune flags

Updated under an hour ago (Oct 28, 2026, 10:23 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Avoid bitfield RMW for claim/retune flags Move claimed and retune control flags out of the bitfield word to avoid unrelated RMW side effects in asynchronous contexts. The host->claimed bit shared a word with retune flags. Writes to claimed in __mmc_claim_host() or retune_now in mmc_mq_queue_rq() can overwrite other bits when concurrent updates happen in other contexts, triggering spurious WARN_ON(!host->claimed). Convert claimed, can_retune, retune_now and retune_paused to bool to remove shared-word coupling.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 13, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 6c0cedd1ef9527ef13e66875746570e76a3188a7 before 41dce4dae583a8ce06a7ebf4ce704c46a142957c; from 6c0cedd1ef9527ef13e66875746570e76a3188a7 before bb7fc2498c3bb25fa6a91f22f4760005325cfbd5; from 6c0cedd1ef9527ef13e66875746570e76a3188a7 before 270277c2ab631044867adb1bd2f2433d3892de6e; from 6c0cedd1ef9527ef13e66875746570e76a3188a7 before 45038e03f15e992c48603fff8c6b1c9be5397ac9; 6c0cedd1ef9527ef13e66875746570e76a3188a7 builds before 0e06cc511c61cff1591e5435a207759adcc76b6d; from 6c0cedd1ef9527ef13e66875746570e76a3188a7 before d3a3caf44c8ec26f5d63dc17c1c7242effa60ebc; from 6c0cedd1ef9527ef13e66875746570e76a3188a7 before 901084c51a0a8fb42a3f37d2e9c62083c495f824	CNA record
linux linux_kernel linux:linux_kernel	from 4.15 before 5.15.203; from 5.16 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.78; from 6.13 before 6.18.19; from 6.19 before 6.19.9; 7.0	NVD

References

References

https://git.kernel.org/stable/c/41dce4dae583a8ce06a7ebf4ce704c46a142957c	patch
https://git.kernel.org/stable/c/bb7fc2498c3bb25fa6a91f22f4760005325cfbd5	patch
https://git.kernel.org/stable/c/270277c2ab631044867adb1bd2f2433d3892de6e	patch
https://git.kernel.org/stable/c/45038e03f15e992c48603fff8c6b1c9be5397ac9	patch
https://git.kernel.org/stable/c/0e06cc511c61cff1591e5435a207759adcc76b6d	patch
https://git.kernel.org/stable/c/d3a3caf44c8ec26f5d63dc17c1c7242effa60ebc	patch
https://git.kernel.org/stable/c/901084c51a0a8fb42a3f37d2e9c62083c495f824	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.