Answer in brief
CVE-2026-99035 records a Unknown severity vulnerability in mmc: mtk-sd: Cancel request timeout work on remove. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=208489032bdd8d4a7de50f3057c175058f271956 <9e799f25c420e759641eb25102967ea091fc758f || >=208489032bdd8d4a7de50f3057c175058f271956 <f37e0367ad6f2147a0b37564b442b7a25bec0d23 || >=208489032bdd8d4a7de50f3057c175058f271956 <46e75703ca3f00fb8c935b3ce35b90836e34e8af || >=208489032bdd8d4a7de50f3057c175058f271956 <edef1355224c0799a502a46b71d3649fa0dd218e || >=208489032bdd8d4a7de50f3057c175058f271956 <b38af5386a74416e898955443f2e26547b358cb2 | 9e799f25c420e759641eb25102967ea091fc758f, f37e0367ad6f2147a0b37564b442b7a25bec0d23, 46e75703ca3f00fb8c935b3ce35b90836e34e8af, edef1355224c0799a502a46b71d3649fa0dd218e, b38af5386a74416e898955443f2e26547b358cb2 |
| Linux/Linuxgeneric | 4.2 | Not reported |
Published upstream
Oct 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 23, 2026
In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues req_timeout while a request is active. msdc_request_done() uses cancel_delayed_work(), which does not wait for a timeout callback that has already started. The timeout callback calls mmc_request_done(), which wakes the request waiter, and then continues to use host->dev_comp and check the SDIO IRQ. During unbind, msdc_drv_remove() can return and the managed mmc_host can be freed before the callback finishes. KASAN reported use-after-free accesses in msdc_request_done() and msdc_recheck_sdio_irq() in each of three unbind tests. The same tests completed without a kernel diagnostic after this change. Call cancel_delayed_work_sync() after mmc_remove_host() has stopped new requests and before the driver releases the host resources.
Quoted source text, attributed separately from HOL analysis.