CVE-2026-98211

A flaw was found in the Linux kernel's MultiMediaCard (MMC) host controller interface driver. When the device is removed, the driver fails to cancel pending delayed timeout tasks, allowing scheduled work to access memory that has already been released. A local user capable of triggering device removal could exploit this use-after-free vulnerability to cause a system crash, resulting in a Denial of Service (DoS), or potentially achieve arbitrary code execution.

This vulnerability is rated as Moderate impact because exploitation requires local access to trigger hardware device removal during specific controller timeout states, limiting the risk to systems with specialized ARM MMC interfaces. Typical enterprise server and cloud deployments do not utilize the affected PrimeCell MMC hardware. On supported architectures where the driver is present, an unprivileged user cannot easily trigger driver unbinding or device detachment, substantially constraining the attack surface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.