SB20261023127 - Improper resource shutdown or release in Linux kernel mmc host driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper resource shutdown or release (CVE-ID: CVE-2026-99034)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through incorrect clock handling during device removal.

The vulnerability exists due to improper runtime power management cleanup in sdhci_sprd_remove() in the Linux kernel's Spreadtrum SDHCI driver when removing a runtime-suspended device. A local privileged user can trigger device removal, if permitted, to disable clocks that runtime power management callbacks may have already disabled, potentially disrupting kernel operation.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/03244b8713d044425db5dbee08037ecd79b684f9
• https://git.kernel.org/stable/c/3a1caa886d41d9bcc9a402906336eda34a90d323
• https://git.kernel.org/stable/c/605a59639abb9cb63cd7676460461fb0b34756b3
• https://git.kernel.org/stable/c/dbad91a31c482063c0a87c90aa83c9001972c6ac
• https://git.kernel.org/stable/c/e1c6c10a6a70a69e29b04fcc1ebe4b9bcbc7a49a