CVE-2026-98213

A flaw was found in the Linux kernel's MultiMediaCard (MMC) subsystem. This issue allows a local user to cause a Denial of Service (DoS) or memory corruption. The vulnerability occurs because pending interrupt handling work is not properly cancelled before host memory is freed during device removal, leading to a use-after-free condition when the scheduled worker executes.

A race in the MMC core can leave host sdio_irq_work queued while the associated mmc_host is being removed and freed. If the worker runs after mmc_host_classdev_release has released the host, container_of and later worker accesses can dereference memory that no longer contains a valid mmc_host. The directly supported impact is a local kernel crash or corruption of kernel state. The use after free also creates a plausible worst case risk of privilege escalation if the freed allocation can be reused before the worker accesses it, although reliable control of that reuse is not established by the supplied code. For the CVSS the PR:L in the paranoid score reflects environments where a local service account, reduced capability root, container root, or a user with delegated device management can influence hotplug or controller removal. Reliable triggering on conventional systems will more commonly require administrative device control. The race requires a narrow timing window, so AC:H is appropriate. The issue is not network reachable and normally depends on a host controller that uses sdio_signal_irq.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.