CVE-2026-98213

What the bug is

A host controller that uses sdio_signal_irq() schedules host->sdio_irq_work from its interrupt handler. That work is only cancelled on the suspend path (mmc_sdio_suspend()), not on the remove/free path, so a worker armed just before the controller freed its IRQ can run after mmc_host_classdev_release() has freed the host and dereference it through container_of(). Cancel host->sdio_irq_work in mmc_free_host(), like the existing host->detect drain added by commit 1036f69e2513 ("mmc: core: Cancel delayed work before releasing host"). This issue was found by an in-house static analysis tool.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

drivers/mmc/core/host.c

What this is

MULTIMEDIA CARD (MMC), SECURE DIGITAL (SD) AND SDIO SUBSYSTEMMAINTAINERS section matched on drivers/mmc/ · linux-mmc@vger.kernel.org · Maintained

Kernel module

mmc_core

Check it on the machine

grep -w CONFIG_MMC /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w mmc_core

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.

• bookwormBnot built on amd64/cloud-amd64, arm64/cloud-arm64
• trixieBnot built on amd64/cloud-amd64, arm64/cloud-arm64, s390x/s390x
• forky, sidBnot built on amd64/cloud-amd64, arm64/cloud-arm64, loong64/loong64, s390x/s390x

B

built in on some, a module on others, absent on the rest

Build switch

CONFIG_MMC

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Signals

Published

2026-10-06 (13 days ago)source

CVSS

no vector published, unrated

Attack vector

not published

EPSS

0.21%, higher than 11.0% of all CVEssource

CISA KEV

not listedthe KEV catalogue

Debian urgency

not yet assignedsource

Subsystem

drivers/mmc

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
4.13	6.1.189	bae1cf4f9902
4.13	6.6.158	0bf3d168a2cc
4.13	6.12.112	1d6e7315ee1c
4.13	6.18.54	4553b5004eca
4.13	7.2.8	2a863458828a
4.13	7.3	6feadbecdae6

Debian advisories