{"id":"CVE-2026-99035","kind":"vulnerability","aliases":["CVE-2026-99035"],"related":[],"title":"Linux MediaTek MMC driver: use-after-free when unbinding the host","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: mtk-sd: Cancel request timeout work on remove\n\nThe driver queues req_timeout while a request is active.\nmsdc_request_done() uses cancel_delayed_work(), which does not wait for\na timeout callback that has already started.\n\nThe timeout callback calls mmc_request_done(), which wakes the request\nwaiter, and then continues to use host->dev_comp and check the SDIO IRQ.\nDuring unbind, msdc_drv_remove() can return and the managed mmc_host can\nbe freed before the callback finishes.\n\nKASAN reported use-after-free accesses in msdc_request_done() and\nmsdc_recheck_sdio_irq() in each of three unbind tests.  The same tests\ncompleted without a kernel diagnostic after this change.\n\nCall cancel_delayed_work_sync() after mmc_remove_host() has stopped new\nrequests and before the driver releases the host resources.","summary":"In the Linux kernel's MediaTek mtk-sd MMC driver, a pending request timeout callback can run after the driver is removed, touching freed host memory. The description reports KASAN use-after-free reports during unbind tests, so the likely effect is a kernel crash or memory corruption on unbind.","severity":"unknown","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","infrastructure","kernel","linux","mediatek"],"not_affected_if":["driver-never-unbound","no-mediatek-hardware"],"how_to_check":"- Check whether the MediaTek mtk-sd MMC driver is loaded, for example with `lsmod | grep mtk_sd` or by looking for an mtk-sd device bound under /sys/bus/platform/drivers/.\n- Compare the running kernel with the fixed release: `uname -r`.","fix":"- Update to a Linux kernel release that includes the upstream commit adding cancel_delayed_work_sync() to msdc_drv_remove (version unknown from the sources).","status":"open","published_at":"2026-10-23T13:17:26+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:54:21+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T04:54:21Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit adding cancel_delayed_work_sync() to msdc_drv_remove (version unknown from the sources).","reach":"local","title":"Linux MediaTek MMC driver: use-after-free when unbinding the host","impact":"medium","summary":"In the Linux kernel's MediaTek mtk-sd MMC driver, a pending request timeout callback can run after the driver is removed, touching freed host memory. The description reports KASAN use-after-free reports during unbind tests, so the likely effect is a kernel crash or memory corruption on unbind.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","mediatek","embedded"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel memory corruption or crash when the driver unbinds","analyst_note":"Find the fixed kernel version and the upstream commit for the mtk-sd cancel_delayed_work_sync change, via the NVD entry or the stable kernel git log.","how_to_check":"- Check whether the MediaTek mtk-sd MMC driver is loaded, for example with `lsmod | grep mtk_sd` or by looking for an mtk-sd device bound under /sys/bus/platform/drivers/.\n- Compare the running kernel with the fixed release: `uname -r`.","needs_analyst":true,"not_affected_if":["no-mediatek-hardware","driver-never-unbound"],"who_is_affected":"Only systems running a Linux kernel with the MediaTek mtk-sd MMC host driver, typically MediaTek-based boards and devices, where the driver can be unbound. The sources do not describe a remote trigger, so ordinary servers without this hardware are unlikely to be exposed. Systems that never unbind this driver are unlikely to hit the race.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00069,"input_tokens":3532,"output_tokens":673,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99035':15A,18A 'access':175C 'activ':105C 'alreadi':123C 'call':128C,202C 'callback':39B,120C,127C,167C 'cancel':90C,110C,203C 'chang':201C 'check':146C 'comp':144C 'complet':194C 'continu':139C 'corrupt':73B 'crash':70B 'cve':13A,16A 'delay':111C,204C 'descript':52B 'dev':143C 'diagnost':198C 'done':108C,131C,179C 'driver':4A,34B,44B,97C,218C 'drv':153C 'effect':66B 'embed':19B 'finish':168C 'follow':81C 'free':8A,58B,174C 'freed':48B,164C 'host':12A,49B,142C,161C,210C,221C 'infrastructur':20B 'irq':149C,184C 'kasan':54B,169C 'kernel':21B,27B,69B,79C,197C 'like':65B 'linux':1A,22B,26B,78C 'manag':159C 'mediatek':2A,23B,29B 'memori':50B,72B 'mmc':3A,33B,86C,129C,160C,208C 'msdc':106C,152C,177C,181C 'mtk':31B,88C 'mtk-sd':30B,87C 'new':213C 'pend':36B 'queue':98C 'recheck':182C 'releas':219C 'remov':46B,95C,154C,209C 'report':53B,59B,170C 'req':99C 'request':37B,91C,103C,107C,130C,135C,178C,214C 'resolv':85C 'resourc':222C 'return':156C 'run':41B 'sd':32B,89C 'sdio':148C,183C 'start':124C 'stop':212C 'sync':206C 'test':62B,190C,193C 'three':188C 'timeout':38B,92C,100C,119C,126C 'touch':47B 'unbind':10A,61B,75B,151C,189C 'use':6A,56B,109C,141C,172C 'use-after-fre':5A,55B,171C 'vulner':82C 'wait':116C 'waiter':136C 'wake':133C 'without':195C 'work':93C,112C,205C","nicknames":[],"mitigations":[],"who_affected":"Only systems running a Linux kernel with the MediaTek mtk-sd MMC host driver, typically MediaTek-based boards and devices, where the driver can be unbound. The sources do not describe a remote trigger, so ordinary servers without this hardware are unlikely to be exposed. Systems that never unbind this driver are unlikely to hit the race.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99035","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99035","severity":null,"published_at":"2026-10-23T13:17:26+00:00","modified_at":"2026-10-23T13:17:26+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-99035","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99035","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}