Cloudanix VulnDB

CVE-2026-98212

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing flaw in Linux storage drivers can let the system try to use memory that has already been freed, which may crash the machine or let an attacker take control during device removal.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free where pending retry_work embedded in a devm-allocated mmc_hsq structure executes after driver removal frees the allocation, dereferencing hsq->mmc and hsq->mrq.

Why it matters to the business

Kernel instability or potential code execution on affected MMC/SD card controllers during driver unbind or hot removal, risking system crashes and data loss on embedded or server hardware using sdhci-sprd or similar atomic-request drivers.

How an attack unfolds

An attacker with local access triggers repeated MMC request failures to arm retry_work, then forces driver removal or module unload so the still-pending work runs after the mmc_hsq structure is freed by devm, causing the use-after-free.

How to fix it

Apply the upstream fix that replaces manual work queuing with devm_work_autocancel() to ensure retry_work is cancelled before devm release; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Inspect mmc_hsq.c for the devm_work_autocancel call site around retry_work initialization and confirm mmc_remove_host stops new requests before devres cleanup; test hot-unplug and module unload under load.

Typical attack path

  1. Trigger -EBUSY from request_atomic in mmc_hsq_pump_requests to queue retry_work
  2. Initiate mmc host removal or driver unbind while work remains pending
  3. Allow devm cleanup to free mmc_hsq before work executes
  4. Work dereferences freed pointers leading to crash or exploitation

How to detect it

Monitor kernel logs for oops or panic messages referencing mmc_hsq_pump_requests, retry_work, or use-after-free dereferences of mmc/mrq pointers during module unload or card removal events.

  • mmc_hsq_pump_requests
  • retry_work
  • hsq->mmc
  • hsq->mrq
  • devm_work_autocancel

What your security team should do

  • Immediately schedule kernel updates containing the devm_work_autocancel change
  • Audit systems using sdhci-sprd or custom request_atomic MMC drivers for exposure
  • Add kernel oops monitoring for hsq retry paths until patched

The record

In the Linux kernel, the following vulnerability has been resolved: mmc: hsq: Fix use-after-free in retry work mmc_hsq_pump_requests() queues retry_work when request_atomic() returns -EBUSY; today sdhci-sprd is the only consumer that implements request_atomic(). The work is embedded in a devm-allocated mmc_hsq, but is never cancelled during driver removal. Work still pending at unbind can therefore run after the devm allocation has been released and dereference hsq->mmc and hsq->mrq. Use devm_work_autocancel() to cancel and drain retry_work before the devm allocation is released. By the time devres cleanup begins, mmc_remove_host() has already stopped the host, so no new requests can arm the work. This issue was found by an in-house static analysis tool.

Affected packages

Ecosystem Package Introduced Fixed