CVE-2026-98211

In the Linux kernel, the following vulnerability has been resolved: mmc: mmci: Fix use-after-free in busy-timeout work ux500busycomplete can queue ux500busytimeoutwork for an R1b command, but mmciremove never cancels it. The work can subsequently dereference the devm-allocated mmcihost after it h...

CVE-2026-98211

In the Linux kernel, the following vulnerability has been resolved: mmc: mmci: Fix use-after-free in busy-timeout work ux500busycomplete can queue ux500busytimeoutwork for an R1b command, but mmciremove never cancels it. The work can subsequently dereference the devm-allocated mmcihost after it h...

EUVD-2026-93139

In the Linux kernel, the following vulnerability has been resolved: mmc: mmci: Fix use-after-free in busy-timeout work ux500busycomplete can queue ux500busytimeoutwork for an R1b command, but mmciremove never cancels it. The work can subsequently dereference the devm-allocated mmcihost after it h...

CVE-2026-98211 mmc: mmci: Fix use-after-free in busy-timeout work

In the Linux kernel, the following vulnerability has been resolved: mmc: mmci: Fix use-after-free in busy-timeout work ux500busycomplete can queue ux500busytimeoutwork for an R1b command, but mmciremove never cancels it. The work can subsequently dereference the devm-allocated mmcihost after it h...

CVE-2026-98211

The Linux kernel contains a use-after-free vulnerability within the mmc: mmci component. The issue occurs because ux500_busy_complete() can queue ux500_busy_timeout_work for an R1b command, but mmci_remove() fails to cancel this work, leading to the dereferencing of the devm-allocated mmci_host a...

CVE-2026-98211

In the Linux kernel, the following vulnerability has been resolved: mmc: mmci: Fix use-after-free in busy-timeout work ux500busycomplete can queue ux500busytimeoutwork for an R1b command, but mmciremove never cancels it. The work can subsequently dereference the devm-allocated mmcihost after it h...

PT-2026-106540

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description A use-after-free issue exists in the mmc: mmci component. The ux500 busy complete function can queue ux500 busy timeout work for an R1b command, but mmci remove fails to cancel it...