« Volver al listado

CVE-2026-98210

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

mmc: mxcmmc: cancel data work and watchdog on remove

mxcmci_remove() frees the host through the devm tail, but neither it nor mmc_remove_host() drains the driver's own asynchronous state. host->watchdog, a 10 s timer armed on the DMA path in mxcmci_setup_data(), is deleted only by the DMA- and IRQ-complete paths, which the remove path does not explicitly drain; it can therefore fire after the host is freed and dereference it in mxcmci_watchdog(). host->datawork, armed from the IRQ handler on the PIO path, is not cancelled by the remove path either.

Leer descripción completaMostrar menos

Free the devm-registered IRQ, then cancel datawork and delete the watchdog in mxcmci_remove(), before dma_release_channel(). Freeing the IRQ first keeps a trailing handler from re-arming datawork between the cancel and the host free. Both callbacks are non-self-rearming.

This issue was found by an in-house static analysis tool.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-98210",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "f6ad0a481342223b2e7ae9f55b154e14f1391ada",
              "lessThan": "740f595f8ad678cb4d79f13edd12851df2492bdd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f6ad0a481342223b2e7ae9f55b154e14f1391ada",
              "lessThan": "d3641afe6ee76d852834a34ef0669eefced32752",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f6ad0a481342223b2e7ae9f55b154e14f1391ada",
              "lessThan": "314966b490323bdcfd3162a1398b00e587e0ced4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f6ad0a481342223b2e7ae9f55b154e14f1391ada",
              "lessThan": "ae10838a7cdf0e54caa9d0a4f488704fd04e7f01",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f6ad0a481342223b2e7ae9f55b154e14f1391ada",
              "lessThan": "a1ff367e0dc961d73707add508a95df5c3509bd1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f6ad0a481342223b2e7ae9f55b154e14f1391ada",
              "lessThan": "23383e0578b58ba2dc0730cf9f7806bd66bf859a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f6ad0a481342223b2e7ae9f55b154e14f1391ada",
              "lessThan": "e2948c4232209e87c861a680f20f1e3cf8a57fec",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f6ad0a481342223b2e7ae9f55b154e14f1391ada",
              "lessThan": "d3a421c82412344022982d5b91ba23194a0a6f29",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/mmc/host/mxcmmc.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.7"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "3.7",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/mmc/host/mxcmmc.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-10-06T09:18:07.333",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/23383e0578b58ba2dc0730cf9f7806bd66bf859a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/314966b490323bdcfd3162a1398b00e587e0ced4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/740f595f8ad678cb4d79f13edd12851df2492bdd",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a1ff367e0dc961d73707add508a95df5c3509bd1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ae10838a7cdf0e54caa9d0a4f488704fd04e7f01",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d3641afe6ee76d852834a34ef0669eefced32752",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d3a421c82412344022982d5b91ba23194a0a6f29",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e2948c4232209e87c861a680f20f1e3cf8a57fec",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: mxcmmc: cancel data work and watchdog on remove\n\nmxcmci_remove() frees the host through the devm tail, but neither it nor\nmmc_remove_host() drains the driver's own asynchronous state.\nhost->watchdog, a 10 s timer armed on the DMA path in mxcmci_setup_data(),\nis deleted only by the DMA- and IRQ-complete paths, which the remove path\ndoes not explicitly drain; it can therefore fire after the host is freed\nand dereference it in mxcmci_watchdog().  host->datawork, armed from the\nIRQ handler on the PIO path, is not cancelled by the remove path either.\n\nFree the devm-registered IRQ, then cancel datawork and delete the watchdog\nin mxcmci_remove(), before dma_release_channel().  Freeing the IRQ first\nkeeps a trailing handler from re-arming datawork between the cancel and\nthe host free.  Both callbacks are non-self-rearming.\n\nThis issue was found by an in-house static analysis tool."
    }
  ],
  "lastModified": "2026-10-06T09:18:07.333",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}