Use-after-free in Linux kernel - CVE-2026-98210

Vulnerability details

The vulnerability allows a local user to trigger access to freed host memory.

The vulnerability exists due to use-after-free in the mxcmmc driver's asynchronous callbacks when removing the driver without draining pending work and the watchdog timer. A local user can trigger driver removal while asynchronous callbacks remain pending to trigger access to freed host memory.

The watchdog is armed on the DMA path with a 10-second timeout. The datawork callback is scheduled by the IRQ handler on the PIO path.

Affected software

How to mitigate CVE-2026-98210

External References

• https://git.kernel.org/stable/c/23383e0578b58ba2dc0730cf9f7806bd66bf859a
• https://git.kernel.org/stable/c/314966b490323bdcfd3162a1398b00e587e0ced4
• https://git.kernel.org/stable/c/740f595f8ad678cb4d79f13edd12851df2492bdd
• https://git.kernel.org/stable/c/a1ff367e0dc961d73707add508a95df5c3509bd1
• https://git.kernel.org/stable/c/ae10838a7cdf0e54caa9d0a4f488704fd04e7f01
• https://git.kernel.org/stable/c/d3641afe6ee76d852834a34ef0669eefced32752
• https://git.kernel.org/stable/c/d3a421c82412344022982d5b91ba23194a0a6f29
• https://git.kernel.org/stable/c/e2948c4232209e87c861a680f20f1e3cf8a57fec

Related Security Bulletins

• Use-after-free in Linux kernel mmc host driver
• Debian update for linux