SB2026081707 - Improper access control in Linux kernel mmc host driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper access control (CVE-ID: CVE-2026-68464)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper access control in the sdhci-esdhc-imx suspend and resume interrupt handling logic when processing a WIFI out-of-band wakeup during a suspend and resume transition. A local attacker can trigger a crafted wakeup and card interrupt sequence to cause a denial of service.

The issue occurs when the usdhc interrupt remains enabled while the controller is still in runtime suspend state, leading to an unhandled interrupt warning.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/4f96903e2fd228aa96013372402d650f6dbe5cb3
• https://git.kernel.org/stable/c/9bf4ee05a1109d889de9151ee78bd80293923f70
• https://git.kernel.org/stable/c/9d87eaf985cef9581b6ed99b461b38e8cd666480