https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 26 Oct 2026 19:36:45 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-99035 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>mmc: mtk-sd: Cancel request timeout work on remove</p> <p>The driver queues req_timeout while a request is active. msdc_request_done() uses cancel_delayed_work(), which does not wait for a timeout callback that has already started.</p> <p>The timeout callback calls mmc_request_done(), which wakes the request waiter, and then continues to use host-&gt;dev_comp and check the SDIO IRQ. During unbind, msdc_drv_remove() can return and the managed mmc_host can be freed before the callback finishes.</p> <p>KASAN reported use-after-free accesses in msdc_request_done() and msdc_recheck_sdio_irq() in each of three unbind tests. The same tests completed without a kernel diagnostic after this change.</p> <p>Call cancel_delayed_work_sync() after mmc_remove_host() has stopped new requests and before the driver releases the host resources.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>mmc: mtk-sd: Cancel request timeout work on remove</p> <p>The driver queues req_timeout while a request is active. msdc_request_done() uses cancel_delayed_work(), which does not wait for a timeout callback that has already started.</p> <p>The timeout callback calls mmc_request_done(), which wakes the request waiter, and then continues to use host-&gt;dev_comp and check the SDIO IRQ. During unbind, msdc_drv_remove() can return and the managed mmc_host can be freed before the callback finishes.</p> <p>KASAN reported use-after-free accesses in msdc_request_done() and msdc_recheck_sdio_irq() in each of three unbind tests. The same tests completed without a kernel diagnostic after this change.</p> <p>Call cancel_delayed_work_sync() after mmc_remove_host() has stopped new requests and before the driver releases the host resources.</p> https://db.gcve.eu/vuln/fkie_cve-2026-99035 https://db.gcve.eu/vuln/ghsa-pwxj-3q2q-r972 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>mmc: mtk-sd: Cancel request timeout work on remove</p> <p>The driver queues req_timeout while a request is active. msdc_request_done() uses cancel_delayed_work(), which does not wait for a timeout callback that has already started.</p> <p>The timeout callback calls mmc_request_done(), which wakes the request waiter, and then continues to use host-&gt;dev_comp and check the SDIO IRQ. During unbind, msdc_drv_remove() can return and the managed mmc_host can be freed before the callback finishes.</p> <p>KASAN reported use-after-free accesses in msdc_request_done() and msdc_recheck_sdio_irq() in each of three unbind tests. The same tests completed without a kernel diagnostic after this change.</p> <p>Call cancel_delayed_work_sync() after mmc_remove_host() has stopped new requests and before the driver releases the host resources.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>mmc: mtk-sd: Cancel request timeout work on remove</p> <p>The driver queues req_timeout while a request is active. msdc_request_done() uses cancel_delayed_work(), which does not wait for a timeout callback that has already started.</p> <p>The timeout callback calls mmc_request_done(), which wakes the request waiter, and then continues to use host-&gt;dev_comp and check the SDIO IRQ. During unbind, msdc_drv_remove() can return and the managed mmc_host can be freed before the callback finishes.</p> <p>KASAN reported use-after-free accesses in msdc_request_done() and msdc_recheck_sdio_irq() in each of three unbind tests. The same tests completed without a kernel diagnostic after this change.</p> <p>Call cancel_delayed_work_sync() after mmc_remove_host() has stopped new requests and before the driver releases the host resources.</p> https://db.gcve.eu/vuln/ghsa-pwxj-3q2q-r972 https://db.gcve.eu/vuln/msrc_cve-2026-99035 msrc_CVE-2026-99035 https://db.gcve.eu/vuln/msrc_cve-2026-99035