Not yet scoredPublished Oct 23, 2026

CVE-2026-99035mmc: mtk-sd: Cancel request timeout work on remove

Updated under an hour ago (Oct 27, 2026, 5:10 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues req_timeout while a request is active. msdc_request_done() uses cancel_delayed_work(), which does not wait for a timeout callback that has already started. The timeout callback calls mmc_request_done(), which wakes the request waiter, and then continues to use host->dev_comp and check the SDIO IRQ. During unbind, msdc_drv_remove() can return and the managed mmc_host can be freed before the callback finishes. KASAN reported use-after-free accesses in msdc_request_done() and msdc_recheck_sdio_irq() in each of three unbind tests. The same tests completed without a kernel diagnostic after this change. Call cancel_delayed_work_sync() after mmc_remove_host() has stopped new requests and before the driver releases the host resources.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 23, 2026
First seen by InfoSec Signals: Oct 23, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	208489032bdd8d4a7de50f3057c175058f271956 builds before 9e799f25c420e759641eb25102967ea091fc758f; from 208489032bdd8d4a7de50f3057c175058f271956 before f37e0367ad6f2147a0b37564b442b7a25bec0d23; 208489032bdd8d4a7de50f3057c175058f271956 builds before 46e75703ca3f00fb8c935b3ce35b90836e34e8af; from 208489032bdd8d4a7de50f3057c175058f271956 before edef1355224c0799a502a46b71d3649fa0dd218e; from 208489032bdd8d4a7de50f3057c175058f271956 before b38af5386a74416e898955443f2e26547b358cb2	CNA record

References

References

https://git.kernel.org/stable/c/9e799f25c420e759641eb25102967ea091fc758f
https://git.kernel.org/stable/c/f37e0367ad6f2147a0b37564b442b7a25bec0d23
https://git.kernel.org/stable/c/46e75703ca3f00fb8c935b3ce35b90836e34e8af
https://git.kernel.org/stable/c/edef1355224c0799a502a46b71d3649fa0dd218e
https://git.kernel.org/stable/c/b38af5386a74416e898955443f2e26547b358cb2

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.