{"apiVersion":"1.0","identifier":"CVE-2026-99035","description":"In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues req_timeout while a request is active. msdc_request_done() uses cancel_delayed_work(), which does not wait for a timeout callback that has already started. The timeout callback calls mmc_request_done(), which wakes the request waiter, and then continues to use host->dev_comp and check the SDIO IRQ. During unbind, msdc_drv_remove() can return and the managed mmc_host can be freed before the callback finishes. KASAN reported use-after-free accesses in msdc_request_done() and msdc_recheck_sdio_irq() in each of three unbind tests. The same tests completed without a kernel diagnostic after this change. Call cancel_delayed_work_sync() after mmc_remove_host() has stopped new requests and before the driver releases the host resources.","publishedAt":"2026-10-23T13:17:26","lastModifiedAt":"2026-10-30T13:21:40","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99035","cvssScore":null,"cvssVector":null,"epssProbability":0.00177,"riskScore":null,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-99035","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-99035","en":"https://www.redsauce.net/en/cves/CVE-2026-99035","fr":"https://www.redsauce.net/fr/cves/CVE-2026-99035","pt":"https://www.redsauce.net/pt/cves/CVE-2026-99035","de":"https://www.redsauce.net/de/cves/CVE-2026-99035","sk":"https://www.redsauce.net/sk/cves/CVE-2026-99035","el":"https://www.redsauce.net/el/cves/CVE-2026-99035"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-99035"}}