CVE-2026-97502 mmc: davinci: avoid NULL deref of host->data in IRQ handler

What is CVE-2026-97502?

CVE-2026-97502 is a vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

mmc: davinci: avoid NULL deref of host->data in IRQ handler

mmc_davinci_irq() returns early only when both host->cmd and host->data are NULL:

if (host->cmd == NULL && host->data == NULL) { ... return IRQ_NONE; }

So we may legitimately reach the rest of the handler with host->data == NULL (and therefore data == NULL). The DATDNE branch already guards against this with an explicit "if (data != NULL)" check, but the subsequent TOUTRD ("read data timeout") and CRCWR/CRCRD ("data CRC error") branches dereference data unconditionally:

if (qstatus & MMCST0_TOUTRD) { data->error = -ETIMEDOUT; <-- NULL deref ... davinci_abort_data(host, data); }

if (qstatus & (MMCST0_CRCWR | MMCST0_CRCRD)) { data->error = -EILSEQ; <-- NULL deref ... }

If either bit is set in qstatus while host->data is NULL, the kernel will crash inside the IRQ handler. smatch flags this:

drivers/mmc/host/davinci_mmc.c:933 mmc_davinci_irq() error: we previously assumed 'data' could be null (see line 914)

Gate both branches on a non-NULL data, matching the existing pattern used by the DATDNE branch.

No functional change for callers where data is non-NULL, which is the only case in which these branches did meaningful work before this change.

Which versions are affected by CVE-2026-97502?

How do I fix CVE-2026-97502?

Apply the vendor's patch.

Is CVE-2026-97502 being exploited?

There is no known exploitation of CVE-2026-97502 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-103793, BELL-CVE-2026-97502, DEBIAN-CVE-2026-97502, GHSA-7j63-m3c7-g76r, UBUNTU-CVE-2026-97502.