Use-after-free in Linux kernel - CVE-2026-98212
Published: October 7, 2026
Vulnerability identifier: #VU153809
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98212
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to trigger access to freed kernel memory.
The vulnerability exists due to use-after-free in the MMC host software queue retry work handler when processing pending retry work after driver removal. A local user can trigger execution of pending retry work after its associated allocation has been released to trigger access to freed kernel memory.
Retry work is queued when request_atomic() returns -EBUSY. The sdhci-sprd driver is the only identified consumer implementing request_atomic().
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98212
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1
External References
- https://git.kernel.org/stable/c/45341b341642c377192c95e4d48e0a859cf85f42
- https://git.kernel.org/stable/c/5d132990475f02cfa1debe03d50b479432864ebd
- https://git.kernel.org/stable/c/8439bf262ce3267bcfee29d3c61605f1731a2271
- https://git.kernel.org/stable/c/c50d6515bffb148c2c12be6d587ec201dfab4c34
- https://git.kernel.org/stable/c/df2eb59fd9eb33663dc1053f5a4ed851e0aa1f67