CVE-2026-98211 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
mmc: mmci: Fix use-after-free in busy-timeout work
ux500_busy_complete() can queue ux500_busy_timeout_work for an R1b command, but mmci_remove() never cancels it. The work can subsequently dereference the devm-allocated mmci_host after it has been released.
Mask the controller interrupts and disable the delayed work during removal. This drains any queued instance and stops an IRQ handler that is still in progress from queueing the work again once it has been disabled.
This issue was found by an in-house static analysis tool.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified within the Linux kernel's MultiMediaCard (MMC) subsystem, specifically affecting the mmci driver for ST-Ericsson Ux500 platforms, represents a critical use-after-free condition that arises from improper resource lifecycle management during device removal operations. The core technical flaw lies in the asynchronous handling of busy timeouts for R1b command types. When an MMC transaction involving an R1b response type is initiated, the driver's completion handler ux500_busy_complete() schedules a delayed work item named ux500_busy_timeout_work to handle potential timeout scenarios. However, during the device removal process executed by mmci_remove(), this specific delayed work item is never explicitly cancelled or flushed from the kernel’s workqueue infrastructure. Consequently, if the driver module is unloaded while such a timed-out operation is pending or in progress, the underlying hardware context and associated host structure are deallocated via devm (device-managed) resources before the scheduled work item executes.
This race condition leads to a use-after-free scenario where ux500_busy_timeout_work attempts to dereference pointers within the mmci_host structure that have already been freed by the kernel’s memory management subsystem. The operational impact of this vulnerability is severe, potentially resulting in kernel panics, system crashes, or unpredictable behavior depending on how quickly the freed memory region is reallocated for other purposes. If an attacker can trigger a sequence of MMC operations followed immediately by device removal or driver unloading, they may exploit this timing window to execute arbitrary code with kernel privileges, thereby compromising the integrity and availability of the entire system. This type of flaw is particularly dangerous in embedded systems where hot-plugging devices or dynamically loading drivers is common practice, as it exposes a persistent attack surface related to resource cleanup routines.
From a classification perspective, this vulnerability aligns closely with CWE-416, Use After Free, which describes situations where a program continues to use a pointer after it has been freed, leading to undefined behavior and potential security breaches. Furthermore, the exploitation vector relates to ATT&CK technique T1059, Command and Scripting Interpreter, specifically through kernel-level script execution if the memory corruption allows for control flow hijacking. The issue was originally detected using an in-house static analysis tool, highlighting the importance of automated code scanning in identifying race conditions and lifecycle mismatches that are often difficult to catch during manual review or standard functional testing.
To mitigate this vulnerability, the primary remediation involves ensuring strict synchronization between device removal and asynchronous work items. As implemented in the fix, the driver must mask controller interrupts before attempting to disable and flush any pending delayed work instances. By disabling the hardware interrupts first, the system prevents new interrupt handlers from queuing additional timeout work after the removal process has begun. Subsequently, flushing or cancelling the existing ux500_busy_timeout_work ensures that no deferred execution occurs against freed memory structures. This approach guarantees that all asynchronous tasks associated with the device are completed or abandoned safely before the host structure is deallocated. System administrators and developers should ensure that kernel updates incorporating this patch are applied promptly to close this window of opportunity for local privilege escalation attacks targeting MMC subsystems on affected hardware platforms.