Incorrect calculation in Linux kernel - CVE-2026-98207

Vulnerability details

The vulnerability allows a local user to cause transfer completion accounting to report incorrect byte counts.

The vulnerability exists due to failure to reset the transferred-byte counter in mmc_spi_request() when retrying a multi-block request after a data CRC error. A local user can issue a multi-block transfer request that encounters a CRC error followed by a successful internal retry to cause transfer completion accounting to report incorrect byte counts.

The data itself is retried. Exploitation depends on an MMC-over-SPI system encountering a data CRC error during the transfer.

Affected software

How to mitigate CVE-2026-98207

External References

• https://git.kernel.org/stable/c/0b8c8504593409954ed1a60db4e437d814e04023
• https://git.kernel.org/stable/c/3ae80c1fb7de4d3331427a955a44807745ac5a33
• https://git.kernel.org/stable/c/4885e587f1afa9e1a573ab66f8c4d94d7b836d86
• https://git.kernel.org/stable/c/57f5e29db63f7c80f1805d89234a74dcdbf60231
• https://git.kernel.org/stable/c/7d2f0ec16b300645f20435a6c3827b15e01419af
• https://git.kernel.org/stable/c/8b0cc8707f65e0f51912e764e1b309b2559db1ec
• https://git.kernel.org/stable/c/d1acf4b9f6e9697406ce84ee9acfb92e094d5c7a
• https://git.kernel.org/stable/c/da4929ee78ee701c3717543840798fedff66c430

Related Security Bulletins

• Incorrect calculation in Linux kernel mmc host driver
• Debian update for linux