CVE-2026-98212
mmc: hsq: Fix use-after-free in retry work
No known exploitation. EPSS puts it in the 10th percentile. Fixed versions are out.
What to do
Find your product and version, then upgrade to the build on the right.
- LinuxAffected: ≥ 6db96e5810e0a6a345b7d78549de7676ae5b2662, < c50d6515bffb148c2c12be6d587ec201dfab4c34Upgrade to: c50d6515bffb148c2c12be6d587ec201dfab4c34Affected: ≥ 6db96e5810e0a6a345b7d78549de7676ae5b2662, < df2eb59fd9eb33663dc1053f5a4ed851e0aa1f67Upgrade to: df2eb59fd9eb33663dc1053f5a4ed851e0aa1f67Affected: ≥ 6db96e5810e0a6a345b7d78549de7676ae5b2662, < 8439bf262ce3267bcfee29d3c61605f1731a2271Upgrade to: 8439bf262ce3267bcfee29d3c61605f1731a2271Affected: ≥ 6db96e5810e0a6a345b7d78549de7676ae5b2662, < 45341b341642c377192c95e4d48e0a859cf85f42Upgrade to: 45341b341642c377192c95e4d48e0a859cf85f42 + 1 more branchStated by: CVE record
Versions as the sources state them. Full version matrix after sign-in
What it is
From the CVE record
In the Linux kernel, the following vulnerability has been resolved: mmc: hsq: Fix use-after-free in retry work mmc_hsq_pump_requests() queues retry_work when request_atomic() returns -EBUSY; today sdhci-sprd is the only consumer that implements request_atomic(). The work is embedded in a devm-allocated mmc_hsq, but is never cancelled during driver removal. Work still pending at unbind can therefore run after the devm allocation has been released and dereference hsq->mmc and hsq->mrq. Use devm_work_autocancel() to cancel and drain retry_work before the devm allocation is released. By the time devres cleanup begins, mmc_remove_host() has already stopped the host, so no new requests can arm the work. This issue was found by an in-house static analysis tool.
In plain language
No plain-language summary for this CVE yet.
Exploitation
Where each signal puts this CVE on the scale from published to confirmed exploited.
- CISA KEV
Not in the catalog. CISA has not confirmed exploitation.
- Public exploits
No public exploit or proof of concept found in the sources we track.
- EPSS
0.2% chance of exploitation activity in the next 30 days, which ranks it in the 10th percentile of scored CVEs.
Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.
Lifecycle
2 events over 0 days, from the signal feeds we watch.
- Publishedrecord updated
Affected products
Sources
References in the record
- git.kernel.org/stable/c/c50d6515bffb148c2c12be6d587ec201dfab4c34
- git.kernel.org/stable/c/df2eb59fd9eb33663dc1053f5a4ed851e0aa1f67
- git.kernel.org/stable/c/8439bf262ce3267bcfee29d3c61605f1731a2271
And 2 more references. See all after sign-in
In the news
Watch the software you run.
My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.
We'll flag the next CVE, public exploit or patch for Linux, not every advisory.
A free account adds
- The full version matrix and every affected product
- Exploit links, proofs of concept and Metasploit modules
- Email alerts for the products you watch
- The same data over REST API, MCP and CLI