Cloudanix VulnDB

CVE-2026-98213

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's handling of SD card hardware interrupts can cause the system to access memory that has already been released, potentially leading to crashes or security bypasses.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in mmc core: sdio_irq_work scheduled from an IRQ handler can execute after mmc_free_host() releases the host structure, causing a container_of() dereference on freed memory.

Why it matters to the business

Systems using SDIO peripherals may experience kernel crashes or memory corruption; low exploitability reduces immediate widespread risk but still requires prompt patching on affected Linux distributions.

How an attack unfolds

An attacker with local access triggers rapid device removal or suspend/resume sequences that arm sdio_irq_work just before the host is freed; the pending work item then runs and accesses the dangling host pointer, enabling memory corruption that can be turned into privilege escalation.

How to fix it

Upgrade to a Linux kernel containing the fix that cancels host->sdio_irq_work inside mmc_free_host(); apply the patch corresponding to commit 1036f69e2513 and subsequent backports for all supported kernel versions.

How to confirm the fix worked

Confirm the presence of the mmc_free_host() cancellation call in the running kernel source or verify the kernel version matches a distribution that lists the fix; test by exercising SDIO device hotplug and suspend paths under memory debugging tools such as KASAN.

Typical attack path

  1. Obtain local code execution or physical access to the target system
  2. Trigger SDIO device insertion/removal or suspend paths that schedule sdio_irq_work
  3. Force mmc_free_host() to run while the work item remains pending
  4. Work executes on freed host memory leading to UAF
  5. Leverage resulting memory corruption for kernel code execution

How to detect it

Review kernel logs for mmc or sdio related oops or use-after-free warnings around device removal; no specific post-exploitation artifacts are known at this time.

What your security team should do

  • Prioritize kernel updates on all systems exposing SDIO interfaces
  • Monitor vendor advisories for backported fixes in LTS kernels
  • Enable kernel hardening features such as KASAN or hardened usercopy in test environments to validate the absence of the UAF

The record

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Cancel SDIO IRQ work before freeing host A host controller that uses sdio_signal_irq() schedules host->sdio_irq_work from its interrupt handler. That work is only cancelled on the suspend path (mmc_sdio_suspend()), not on the remove/free path, so a worker armed just before the controller freed its IRQ can run after mmc_host_classdev_release() has freed the host and dereference it through container_of(). Cancel host->sdio_irq_work in mmc_free_host(), like the existing host->detect drain added by commit 1036f69e2513 ("mmc: core: Cancel delayed work before releasing host"). This issue was found by an in-house static analysis tool.

Affected packages

Ecosystem Package Introduced Fixed