am335xbootrom

Reverse Engineering the AM335x Boot ROM It's probably been eighteen months since I first got my hands a few Beaglebone Black boards, saved from the dumpster. Unfortunately, the boards didn't work right away. Now, this was my first time working with one of these boards, or any single board compute...

CVE-2026-99035

In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues reqtimeout while a request is active. msdcrequestdone uses canceldelayedwork, which does not wait for a timeout callback that has already started. The timeout...

CVE-2026-99035

The Linux kernel contains a vulnerability in the mmc: mtk-sd driver where a use-after-free access occurs during the unbind process. The root cause is that msdc_drv_remove() can return and free the managed mmc_host before a req_timeout callback finishes executing. The callback incorrectly continue...

CVE-2026-99034

The Linux kernel contains a vulnerability in the sdhci-sprd driver where the sdhci_sprd_remove() function fails to perform necessary runtime PM cleanup . While sdhci_sprd_probe() enables runtime PM, the removal path directly disables clocks managed by runtime PM callbacks without proper cleanup. ...

EUVD-2026-108829

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-sprd: disable runtime PM on remove sdhcisprdprobe enables runtime PM, while sdhcisprdremove does not perform the corresponding runtime PM cleanup. The probe failure path disables runtime PM before disabling the clocks,...

CVE-2026-99034

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-sprd: disable runtime PM on remove sdhcisprdprobe enables runtime PM, while sdhcisprdremove does not perform the corresponding runtime PM cleanup. The probe failure path disables runtime PM before disabling the clocks,...

EUVD-2026-108678

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Add validation for host-provided maxsegs The maxsegs field is of type unsigned short, and if a host driver sets an excessively large value, it may be truncated to zero. This can cause mmcallocsg to call kmallocobjs wit...

CVE-2026-98884

The Linux kernel contains a vulnerability in the mmc core where an excessively large max_segs value provided by a host driver can be truncated to zero. This causes mmc_alloc_sg() to request a zero-sized allocation via kmalloc_objs(), returning a ZERO_SIZE_PTR under the SLUB allocator. Subsequent ...

CVE-2026-98884

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Add validation for host-provided maxsegs The maxsegs field is of type unsigned short, and if a host driver sets an excessively large value, it may be truncated to zero. This can cause mmcallocsg to call kmallocobjs wit...

CVE-2026-98884 mmc: core: Add validation for host-provided max_segs

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Add validation for host-provided maxsegs The maxsegs field is of type unsigned short, and if a host driver sets an excessively large value, it may be truncated to zero. This can cause mmcallocsg to call kmallocobjs wit...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Avoid using the bitfield RMW for control flags related to claims/retunes. Move the control flags related to claims and retunes out of the bitfield to avoid unrelated side effects of RMW in asynchronous contexts. The...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: fix use-after-free on probe failure The vub300 driver manages its controller state using vub300-kref. The vub300delete function frees the mmc host when the last reference to it is dropped. However, the error path aft...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mmc: davinci: Do not perform the strip or remove function when the driver is built-in. Using exit for the remove function results in the remove callback being discarded when CONFIGMMCDAVINCI=y is enabled. When such a device becom...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: mmc: atmel-mci: fixed the return value check in mmcaddhost The mmcaddhost function may return an error. If we ignore its return value, it will cause two issues: 1. The memory allocated in mmcallochost may be leaked. 2. In the...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: mmc: wmt-sdmmc: Fix the return value check in mmcaddhost. The mmcaddhost function may return an error. If we ignore its return value, the memory allocated in the mmcallochost function will be leaked. This can lead to a kernel...

Astra Linux – Vulnerability in Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Avoid negative index with array access The commit 4d0c8d0aef63 “mmc: core: Use mrq.sbc in close-ended ffu” assigns previdata = idatasi - 1, but does not check that the iterator i is greater than zero. We will fix this ...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mmc: jz4740: Apply DMA engine limits to maximum segment size Follow the approach used in other DMA-enabled MMC host drivers see host/mmci.c, and limit the maximum segment size based on the capabilities of the DMA engine. This is...

CVE-2026-98207

A flaw was found in the Linux kernel's MultiMediaCard Serial Peripheral Interface MMC SPI driver. A local user or connected device can trigger this flaw during multi-block data transfers that encounter a Cyclic Redundancy Check CRC transmission error. The driver initiates a recovery retry without...

SUSE CVE-2026-98208

In the Linux kernel, the following vulnerability has been resolved: mmc: sdiouart: fix xmitfifo leak when the port table is full sdiouartaddport allocates the transmit fifo before claiming a slot in sdiouarttable. When all UARTNR slots are taken, it returns -EBUSY with the fifo still allocated, b...

SUSE CVE-2026-98209

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-of-aspeed: Remove children before releasing SDC resources Probe failure and removal leave SDHCI child devices registered after the parent clock and managed resources are released. Unregister the OF children in reverse...