Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-98213— mmc: core: Cancel SDIO IRQ work before freeing host

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： mmc: core: 在释放主机控制器前取消 SDIO IRQ 工作队列 使用 的主机控制器会从其中断处理程序中调度 。该工作队列仅在挂起路径（ ）中被取消，而在移除/释放路径中并未被取消。因此，如果主机控制器在释放其 IRQ 之前恰好启动了工作队列，那么在 释放主机控制器并通过 解引用它之后，该工作队列仍可能运行，从而导致野指针解引用问题。 在 中取消 ，类似于由提交 1036f69e2513（"mmc: core: 在释放主机前取消延迟工作队列"）中添加的现有 清理

AI Predicted 6.5 Difficulty: Hard EPSS 0.21% · P11

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 14

VendorProduct Version RangeStatus
Linux Linux 682696605c7093d2800c498c04166831e5aedf87< bae1cf4f9902b2065bd78b759c7fe6312855f05e affected
682696605c7093d2800c498c04166831e5aedf87< 0bf3d168a2cc20b120d6b50f0a8ac5b40ff4d589 affected
682696605c7093d2800c498c04166831e5aedf87< 1d6e7315ee1c992b4ca42c9b11c5ed0e925a00e0 affected
682696605c7093d2800c498c04166831e5aedf87< 4553b5004eca9c9eae29a421f1a9c4d5db2c9114 affected
682696605c7093d2800c498c04166831e5aedf87< 2a863458828ade0671c2bc2e469bbd7f2340eb03 affected
682696605c7093d2800c498c04166831e5aedf87< 6feadbecdae60a6324c967f3b1493741083793a3 affected
4.13 affected
< 4.13 unaffected
… +6 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-98213

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
mmc: core: Cancel SDIO IRQ work before freeing host
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: mmc: core: Cancel SDIO IRQ work before freeing host A host controller that uses sdio_signal_irq() schedules host->sdio_irq_work from its interrupt handler. That work is only cancelled on the suspend path (mmc_sdio_suspend()), not on the remove/free path, so a worker armed just before the controller freed its IRQ can run after mmc_host_classdev_release() has freed the host and dereference it through container_of(). Cancel host->sdio_irq_work in mmc_free_host(), like the existing host->detect drain added by commit 1036f69e2513 ("mmc: core: Cancel delayed work before releasing host"). This issue was found by an in-house static analysis tool.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 682696605c7093d2800c498c04166831e5aedf87 ~ bae1cf4f9902b2065bd78b759c7fe6312855f05e -
Linux Linux 4.13 -

II. Public POCs for CVE-2026-98213

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-98213

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-98213 (6)

Same Patch Batch · Linux · 2026-10-06 · 208 CVEs total

CVE-2026-98323 9.8 CRITICAL RDMA/siw: Bound fragmented header copies by the remaining length
CVE-2026-98365 9.8 CRITICAL RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access
CVE-2026-98282 8.8 HIGH powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
CVE-2026-98283 8.8 HIGH KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
CVE-2026-98339 8.8 HIGH wifi: cfg80211: don't filter by BSS type when removing stale entries
CVE-2026-98171 8.8 HIGH smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
CVE-2026-98261 8.1 HIGH cifs: Fix server use-after-free in cifs_chan_skip_or_disable()
CVE-2026-98357 8.1 HIGH IB/isert: wait for deferred control PDU completions before releasing the connection
CVE-2026-98239 8.1 HIGH net: lan743x: fix RX checksum use-after-free
CVE-2026-98341 7.8 HIGH wifi: cfg80211: don't free driver-owned scan requests
CVE-2026-98324 7.8 HIGH dmaengine: pxa: fix double counting of the hw descriptors
CVE-2026-98228 7.8 HIGH mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ
CVE-2026-98229 7.8 HIGH xfrm: save input state data before secpath resets
CVE-2026-98320 7.8 HIGH netfilter: flowtable: hold reference on ct until flow is released
CVE-2026-98318 7.8 HIGH smb: client: validate absolute native symlink targets before NT fixups
CVE-2026-98315 7.8 HIGH ntfs: protect runlist updates with the runlist lock
CVE-2026-98260 7.8 HIGH exec: Cleanup POSIX timers right after de_thread()
CVE-2026-98256 7.8 HIGH signal: Prevent exec() race
CVE-2026-98258 7.8 HIGH posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list
CVE-2026-98254 7.8 HIGH swiotlb: use the adjusted address for the highmem page lookup

Showing top 20 of 208 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-98213

No comments yet

Leave a comment