{"id":"CVE-2026-98884","kind":"vulnerability","aliases":["CVE-2026-98884"],"related":[],"title":"Linux kernel MMC core: invalid host max_segs crashes on SD card init","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: core: Add validation for host-provided max_segs\n\nThe max_segs field is of type unsigned short, and if a host driver\nsets an excessively large value, it may be truncated to zero. This\ncan cause mmc_alloc_sg() to call kmalloc_objs() with a zero size\nallocation request, which leads to undefined behavior.\n\nUnder the SLUB allocator, kmalloc(0) returns a special pointer\n(ZERO_SIZE_PTR). The subsequent 'if (sg)' check will evaluate to\ntrue, and sg_init_table() will then attempt to access invalid memory,\nresulting in a crash:\n\ndwmmc_rockchip 2a310000.mmc: Successfully tuned phase to 133\nmmc1: new UHS-I speed SDR104 SDHC card at address aaaa\nUnable to handle kernel paging request at virtual address 0000001ffffffff0\nMem abort info:\nESR = 0x0000000096000004\nEC = 0x25: DABT (current EL), IL = 32 bits\nSET = 0, FnV = 0\nEA = 0, S1PTW = 0\nFSC = 0x04: level 0 translation fault\nData abort info:\nISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\nCM = 0, WnR = 0, TnD = 0, TagAccess = 0\nGCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\nuser pgtable: 4k pages, 48-bit VAs, pgdp=0000000102c88000\n[0000001ffffffff0] pgd=0000000000000000, p4d=0000000000000000\nInternal error: Oops: 0000000096000004 [#1] SMP\nModules linked in:\nCPU: 2 UID: 0 PID: 102 Comm: kworker/2:1 Not tainted 7.0.0-rc6-next-20260331-00013-g4d93c25963c5-dirty #80 PREEMPT\nHardware name: Rockchip RK3576 EVB V10 Board (DT)\nWorkqueue: events_freezable mmc_rescan\npstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : sg_init_table+0x2c/0x50\nlr : sg_init_table+0x24/0x50\nsp : ffff8000837db710\nx29: ffff8000837db710 x28: 000000000000c000 x27: 0000000000000300\nx26: 0000000000000000 x25: 0000000000000040 x24: ffff0000c46a0000\nx23: 0000000000000000 x22: ffff0000c0c73c00 x21: 0000000000000010\nx20: 0000000000000010 x19: 0000000000000000 x18: 000000000000002c\nx17: 0000000000000000 x16: 0000000000000001 x15: 0000000000000000\nx14: 0000000000000400 x13: ffff8000837dc000 x12: 0000000000000000\nx11: ffff0000c0c73ca0 x10: 0000000000000040 x9 : 459ec1f0abbdbb00\nx8 : 0000001fffffffe0 x7 : 0000000000000000 x6 : 000000000000003f\nx5 : 0000000000035579 x4 : 0000000000000901 x3 : 0000000000000000\nx2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000010\nCall trace:\nsg_init_table+0x2c/0x50 (P)\nmmc_mq_init_request+0x64/0x90\nblk_mq_alloc_map_and_rqs+0x3ac/0x480\nblk_mq_alloc_set_map_and_rqs+0x98/0x1e0\nblk_mq_alloc_tag_set+0x1c0/0x290\nmmc_init_queue+0x120/0x370\nmmc_blk_alloc_req+0x150/0x420\n\nTo prevent this, add a validation check in mmc_mq_init_request() to\ndetect when sg_len (derived from max_segs) is zero. If sg_len is zero,\nwe return an error and print an error message, allowing host driver\ndevelopers to identify and fix incorrect max_segs configuration.\n\nThis is a defensive measure that ensures the MMC core fails gracefully\nwhen host drivers provide invalid max_segs values, rather than crashing\nwith a page fault.","summary":"An MMC host driver that reports an oversized max_segs value gets it truncated to zero, so the kernel makes a zero-size allocation and then faults on memory access during card setup. The fix adds a check in the MMC core that rejects a zero segment count and logs an error instead of crashing.","severity":"unknown","cvss":null,"epss":0.00215,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arm64","embedded","linux-kernel","mmc","runtime","sd-card"],"not_affected_if":["no-mmc-host-controller"],"how_to_check":null,"fix":"- Update the Linux kernel to a release that includes the mmc: core max_segs validation fix (the sources do not name the version).","status":"open","published_at":"2026-10-23T12:18:22+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T05:00:07+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:00:07Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the mmc: core max_segs validation fix (the sources do not name the version).","reach":"local","title":"Linux kernel MMC core: invalid host max_segs crashes on SD card init","impact":"low","summary":"An MMC host driver that reports an oversized max_segs value gets it truncated to zero, so the kernel makes a zero-size allocation and then faults on memory access during card setup. The fix adds a check in the MMC core that rejects a zero segment count and logs an error instead of crashing.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","embedded","arm64","sd-card","mmc"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel crash from a page fault during card initialization","analyst_note":"","how_to_check":"unknown","needs_analyst":false,"not_affected_if":["no-mmc-host-controller"],"who_is_affected":"Systems running a Linux kernel with an MMC/SD host driver that sets max_segs to a value that truncates to zero, on hardware such as the Rockchip RK3576 dwmmc driver shown in the report. The crash happens when an SD or eMMC card is initialized, so machines without such a host controller or with no card slot are not affected. unknown for anything beyond that.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000718,"input_tokens":4722,"output_tokens":492,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':343C,349C,418C,425C,433C,442C,449C,454C,460C '-00013':310C '-2026':15A,18A '-98884':16A,19A '0':157C,233C,235C,237C,239C,243C,250C,256C,258C,260C,262C,264C,266C,268C,270C,297C '0000000000000000':282C,284C,360C,366C,374C,378C,382C,388C,398C,406C,408C,410C '0000000000000001':380C '0000000000000010':370C,372C,412C '000000000000002c':376C '000000000000003f':400C '0000000000000040':362C,392C '0000000000000300':358C '0000000000000400':384C '0000000000000901':404C '000000000000c000':356C '0000000000035579':402C '0000000096000004':288C '0000000102c88000':279C '0000001fffffffe0':396C '0000001ffffffff0':218C,280C '0x00000000':254C '0x0000000096000004':223C '0x00000004':252C '0x04':241C '0x25':225C '1':289C,302C '102':299C '133':196C '2':295C '20260331':309C '2a310000.mmc':191C '32':230C '459ec1f0abbdbb00':394C '48':275C '4k':273C '7.0.0':305C '80':314C '80000005':330C 'aaaa':208C 'abort':220C,247C 'access':60B,182C 'add':66B,98C,465C 'address':207C,217C 'alloc':54B,135C,145C,155C,429C,437C,446C,458C 'allow':499C 'arm64':20B 'attempt':180C 'behavior':151C 'bit':231C,276C 'blk':427C,435C,444C,457C 'board':322C 'btype':338C 'call':138C,413C 'card':12A,29B,62B,205C 'caus':133C 'check':68B,169C,468C 'cm':255C 'comm':300C 'configur':510C 'core':4A,72B,97C,520C 'count':78B 'cpu':294C 'crash':9A,85B,188C,533C 'current':227C 'cve':14A,17A 'dabt':226C 'daif':332C 'data':246C 'defens':514C 'deriv':479C 'detect':475C 'develop':502C 'dirti':313C 'dirtybit':267C 'dit':336C 'driver':33B,119C,501C,525C 'dt':323C 'dwmmc':189C 'ea':236C 'ec':224C 'el':228C 'embed':21B 'ensur':517C 'error':82B,286C,493C,497C 'esr':222C 'evalu':171C 'evb':320C 'event':325C 'excess':122C 'fail':521C 'fault':57B,245C,537C 'ffff0000c0c73c00':368C 'ffff0000c0c73ca0':390C 'ffff0000c46a0000':364C 'ffff8000837db710':352C,354C 'ffff8000837dc000':386C 'field':109C 'fix':65B,506C 'fnv':234C 'follow':91C 'freezabl':326C 'fsc':240C 'g4d93c25963c5':312C 'g4d93c25963c5-dirty':311C 'gcs':263C 'get':41B 'grace':522C 'handl':211C 'hardwar':316C 'host':6A,32B,102C,118C,500C,524C 'host-provid':101C 'identifi':504C 'il':229C 'incorrect':507C 'info':221C,248C 'init':13A,176C,341C,347C,416C,423C,452C,472C 'instead':83B 'intern':285C 'invalid':5A,183C,527C 'iss':251C 'iss2':253C 'isv':249C 'kernel':2A,24B,48B,89C,212C 'kmalloc':139C,156C 'kworker/2':301C 'larg':123C 'lead':148C 'len':478C,487C 'level':242C 'link':292C 'linux':1A,23B,88C 'linux-kernel':22B 'log':80B 'lr':345C 'make':49B 'map':430C,439C 'max':7A,38B,104C,107C,481C,508C,528C 'may':126C 'measur':515C 'mem':219C 'memori':59B,184C 'messag':498C 'mmc':3A,25B,31B,71B,96C,134C,327C,421C,451C,456C,470C,519C 'mmc1':197C 'modul':291C 'mq':422C,428C,436C,445C,471C 'name':317C 'new':198C 'next':308C 'nzcv':331C 'obj':140C 'oop':287C 'overlay':265C 'overs':37B 'p':420C 'p4d':283C 'page':213C,274C,536C 'pan':333C 'pc':339C 'pgd':281C 'pgdp':278C 'pgtabl':272C 'phase':194C 'pid':298C 'pointer':161C 'preempt':315C 'prevent':463C 'print':495C 'provid':103C,526C 'pstate':329C 'ptr':164C 'queue':453C 'rather':531C 'rc6':307C 'rc6-next':306C 'reject':74B 'report':35B 'req':459C 'request':146C,214C,424C,473C 'rescan':328C 'resolv':95C 'result':185C 'return':158C,491C 'rk3576':319C 'rockchip':190C,318C 'rqs':432C,441C 'runtim':26B 's1ptw':238C 'sd':11A,28B 'sd-card':27B 'sdhc':204C 'sdr104':203C 'seg':8A,39B,105C,108C,482C,509C,529C 'segment':77B 'set':120C,232C,438C,448C 'setup':63B 'sg':136C,168C,175C,340C,346C,415C,477C,486C 'short':114C 'size':53B,144C,163C 'slub':154C 'smp':290C 'sp':351C 'special':160C 'speed':202C 'ssbs':337C 'subsequ':166C 'success':192C 'tabl':177C,342C,348C,417C 'tag':447C 'tagaccess':261C 'taint':304C 'tco':335C 'tnd':259C 'trace':414C 'translat':244C 'true':173C 'truncat':43B,128C 'tune':193C 'type':112C 'uao':334C 'uh':200C 'uhs-i':199C 'uid':296C 'unabl':209C 'undefin':150C 'unsign':113C 'user':271C 'v10':321C 'valid':99C,467C 'valu':40B,124C,530C 'vas':277C 'virtual':216C 'vulner':92C 'wnr':257C 'workqueu':324C 'x0':411C 'x1':409C 'x10':391C 'x11':389C 'x12':387C 'x120/0x370':455C 'x13':385C 'x14':383C 'x15':381C 'x150/0x420':461C 'x16':379C 'x17':377C 'x18':375C 'x19':373C 'x1c0/0x290':450C 'x2':407C 'x20':371C 'x21':369C 'x22':367C 'x23':365C 'x24':363C 'x24/0x50':350C 'x25':361C 'x26':359C 'x27':357C 'x28':355C 'x29':353C 'x2c/0x50':344C,419C 'x3':405C 'x3ac/0x480':434C 'x4':403C 'x5':401C 'x6':399C 'x64/0x90':426C 'x7':397C 'x8':395C 'x9':393C 'x98/0x1e0':443C 'xs':269C 'zero':45B,52B,76B,130C,143C,162C,484C,489C 'zero-s':51B","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with an MMC/SD host driver that sets max_segs to a value that truncates to zero, on hardware such as the Rockchip RK3576 dwmmc driver shown in the report. The crash happens when an SD or eMMC card is initialized, so machines without such a host controller or with no card slot are not affected. unknown for anything beyond that.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98884","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98884","severity":null,"published_at":"2026-10-23T12:18:22+00:00","modified_at":"2026-10-23T12:18:22+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98884","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98884","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}