CVE-2026-99035

The Linux kernel contains a vulnerability in the mmc: mtk-sd driver where a use-after-free access occurs during the unbind process. The root cause is that msdc_drv_remove() can return and free the managed mmc_host before a req_timeout callback finishes executing. The callback incorrectly continue...

CVE-2026-99035

In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues reqtimeout while a request is active. msdcrequestdone uses canceldelayedwork, which does not wait for a timeout callback that has already started. The timeout...