Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-99035— mmc: mtk-sd: Cancel request timeout work on remove

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： mmc: mtk-sd：在移除时取消请求超时工作 该驱动在请求处于活动状态时会排队一个 任务。 函数使用的是 ，该函数不会等待已经启动的超时回调执行完毕。 超时回调会调用 ，该函数会唤醒等待请求的线程，随后继续访问 并检查 SDIO 中断。在解除绑定（unbind）过程中， 可能会提前返回，导致由内核管理的 在回调完成之前就被释放。 KASAN 在三次解除绑定测试中均报告了 和 函数中存在“释放后使用”（use-after-free）的内存访问问题。应用此修复后，相同的

AI Predicted 8.8 Difficulty: Hard EPSS 0.17% · P6

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 12

VendorProduct Version RangeStatus
Linux Linux 208489032bdd8d4a7de50f3057c175058f271956< 9e799f25c420e759641eb25102967ea091fc758f affected
208489032bdd8d4a7de50f3057c175058f271956< f37e0367ad6f2147a0b37564b442b7a25bec0d23 affected
208489032bdd8d4a7de50f3057c175058f271956< 46e75703ca3f00fb8c935b3ce35b90836e34e8af affected
208489032bdd8d4a7de50f3057c175058f271956< edef1355224c0799a502a46b71d3649fa0dd218e affected
208489032bdd8d4a7de50f3057c175058f271956< b38af5386a74416e898955443f2e26547b358cb2 affected
4.2 affected
< 4.2 unaffected
6.6.160≤ 6.6.* unaffected
… +4 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-99035

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
mmc: mtk-sd: Cancel request timeout work on remove
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues req_timeout while a request is active. msdc_request_done() uses cancel_delayed_work(), which does not wait for a timeout callback that has already started. The timeout callback calls mmc_request_done(), which wakes the request waiter, and then continues to use host->dev_comp and check the SDIO IRQ. During unbind, msdc_drv_remove() can return and the managed mmc_host can be freed before the callback finishes. KASAN reported use-after-free accesses in msdc_request_done() and msdc_recheck_sdio_irq() in each of three unbind tests. The same tests completed without a kernel diagnostic after this change. Call cancel_delayed_work_sync() after mmc_remove_host() has stopped new requests and before the driver releases the host resources.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 208489032bdd8d4a7de50f3057c175058f271956 ~ 9e799f25c420e759641eb25102967ea091fc758f -
Linux Linux 4.2 -

II. Public POCs for CVE-2026-99035

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-99035

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-99035 (4)

Same Patch Batch · Linux · 2026-10-23 · 217 CVEs total

CVE-2026-98959 9.8 CRITICAL btrfs: fix xattr replace when multiple xattrs are packed in the same item
CVE-2026-99078 9.8 CRITICAL net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
CVE-2026-99079 9.8 CRITICAL net/mlx5e: Prevent stale XSK buffer release on refill retry
CVE-2026-98988 8.8 HIGH namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
CVE-2026-99083 8.8 HIGH ksmbd: fix heap out-of-bounds write in krb5_authenticate()
CVE-2026-99082 8.8 HIGH KVM: x86: Use active memslots for the per-vCPU MMIO cache
CVE-2026-98981 8.8 HIGH namespace: unhash a dentry before detaching the mounts on it
CVE-2026-98980 8.8 HIGH namei: don't reveal overmounted entries in refwalk
CVE-2026-98870 8.8 HIGH ksmbd: remove stale channels from all sessions on teardown
CVE-2026-98978 8.4 HIGH namespace: never expire a locked mount
CVE-2026-99042 8.4 HIGH io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
CVE-2026-98968 8.1 HIGH amt: send the relay's General Query directly from the receive path
CVE-2026-99064 8.1 HIGH cipso: adjust cached option offsets when removing CIPSO
CVE-2026-99014 7.8 HIGH Bluetooth: hci_sync: Fix command skb lifetime during scan setup
CVE-2026-98999 7.8 HIGH drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin
CVE-2026-99016 7.8 HIGH riscv: futex: untag the user pointer before the atomic access
CVE-2026-99018 7.8 HIGH riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp
CVE-2026-99051 7.8 HIGH fsverity: RCU-delay the freeing of struct fsverity_info
CVE-2026-99054 7.8 HIGH tipc: destroy topsrv workqueues before closing connections
CVE-2026-99053 7.8 HIGH tipc: hold a reference to nodes found by link name

Showing top 20 of 217 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux