Not yet scoredPublished Oct 6, 2026

CVE-2026-98213mmc: core: Cancel SDIO IRQ work before freeing host

Updated under an hour ago (Oct 27, 2026, 10:00 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Cancel SDIO IRQ work before freeing host A host controller that uses sdio_signal_irq() schedules host->sdio_irq_work from its interrupt handler. That work is only cancelled on the suspend path (mmc_sdio_suspend()), not on the remove/free path, so a worker armed just before the controller freed its IRQ can run after mmc_host_classdev_release() has freed the host and dereference it through container_of(). Cancel host->sdio_irq_work in mmc_free_host(), like the existing host->detect drain added by commit 1036f69e2513 ("mmc: core: Cancel delayed work before releasing host"). This issue was found by an in-house static analysis tool.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 682696605c7093d2800c498c04166831e5aedf87 before bae1cf4f9902b2065bd78b759c7fe6312855f05e; 682696605c7093d2800c498c04166831e5aedf87 builds before 0bf3d168a2cc20b120d6b50f0a8ac5b40ff4d589; 682696605c7093d2800c498c04166831e5aedf87 builds before 1d6e7315ee1c992b4ca42c9b11c5ed0e925a00e0; 682696605c7093d2800c498c04166831e5aedf87 builds before 4553b5004eca9c9eae29a421f1a9c4d5db2c9114; 682696605c7093d2800c498c04166831e5aedf87 builds before 2a863458828ade0671c2bc2e469bbd7f2340eb03; 682696605c7093d2800c498c04166831e5aedf87 builds before 6feadbecdae60a6324c967f3b1493741083793a3	CNA record

References

References

https://git.kernel.org/stable/c/bae1cf4f9902b2065bd78b759c7fe6312855f05e
https://git.kernel.org/stable/c/0bf3d168a2cc20b120d6b50f0a8ac5b40ff4d589
https://git.kernel.org/stable/c/1d6e7315ee1c992b4ca42c9b11c5ed0e925a00e0
https://git.kernel.org/stable/c/4553b5004eca9c9eae29a421f1a9c4d5db2c9114
https://git.kernel.org/stable/c/2a863458828ade0671c2bc2e469bbd7f2340eb03
https://git.kernel.org/stable/c/6feadbecdae60a6324c967f3b1493741083793a3

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.