CVE-2026-98211

What it actually does

Use-after-free in ux500_busy_complete work queue handler that dereferences a devm-allocated mmci_host structure after mmci_remove has released it because the delayed work is never canceled.

Why it matters to the business

Kernel crashes, memory corruption, or denial of service on systems using affected MMC controllers, potentially causing unplanned downtime or requiring reboots during device removal or module unload operations.

How an attack unfolds

An attacker with local access triggers an R1b command that schedules ux500_busy_timeout_work, then forces device removal or driver unload via hotplug or module operations before the work runs; the still-queued work then accesses the already-freed mmci_host object.

How to fix it

Apply the upstream fix that masks controller interrupts and disables the delayed work during removal to drain queued instances; rebuild and deploy the patched kernel across affected systems.

How to confirm the fix worked

Confirm the presence of the interrupt-masking and work-cancel logic in mmci_remove in the running kernel source or binary; test device removal under load while monitoring for use-after-free warnings in the kernel log.

Typical attack path

1. Obtain local access on a Linux system with the vulnerable mmci driver loaded
2. Issue an R1b MMC command that queues the busy-timeout work
3. Trigger mmci_remove through module unload, hot-unplug, or driver rebind
4. Allow the queued work to execute and dereference the released host structure

How to detect it

Review kernel logs for use-after-free warnings or slab allocator errors mentioning mmci or ux500_busy; inspect dmesg and audit logs for unexpected module unloads or MMC device removals coinciding with crashes.

What your security team should do

• Prioritize patching Linux kernels containing the mmci driver on all production systems within the next maintenance window
• Monitor for kernel oops or slab corruption events related to mmci_host structures
• Restrict unprivileged module loading and hotplug operations where feasible until patches are deployed