CVE-2026-99035 mmc: mtk-sd: Cancel request timeout work on remove
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-99035?
CVE-2026-99035 is a vulnerability in Linux, published on 23 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mmc: mtk-sd: Cancel request timeout work on remove
The driver queues req_timeout while a request is active. msdc_request_done() uses cancel_delayed_work(), which does not wait for a timeout callback that has already started.
The timeout callback calls mmc_request_done(), which wakes the request waiter, and then continues to use host->dev_comp and check the SDIO IRQ. During unbind, msdc_drv_remove() can return and the managed mmc_host can be freed before the callback finishes.
KASAN reported use-after-free accesses in msdc_request_done() and msdc_recheck_sdio_irq() in each of three unbind tests. The same tests completed without a kernel diagnostic after this change.
Call cancel_delayed_work_sync() after mmc_remove_host() has stopped new requests and before the driver releases the host resources.
Which versions are affected by CVE-2026-99035?
How do I fix CVE-2026-99035?
Upgrade to a fixed version.
Is CVE-2026-99035 being exploited?
There is no known exploitation of CVE-2026-99035 in the wild and no public exploit code.
Sources
Also known as AZL-110900, BELL-CVE-2026-99035, DEBIAN-CVE-2026-99035, GHSA-pwxj-3q2q-r972, UBUNTU-CVE-2026-99035.