CVE-2026-99035 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, System administrators and users of Linux-based systems, Security teams and vulnerability management teams, Operators and platform administrators responsible for Linux-based infrastructure

Why it matters

A use-after-free vulnerability in the Linux kernel's mmc: mtk-sd driver can lead to system instability, potential privilege escalation, and requires prompt patching and monitoring.

• Potential system crashes or instability due to use-after-free accesses
• Possible elevation of privileges or unauthorized access
• Required verification of Linux kernel versions and application of patches
• Monitoring system logs for signs of exploitation

Technical summary

The Linux kernel's mmc: mtk-sd driver is vulnerable to a use-after-free issue. When a request timeout work is not properly canceled during removal, it can lead to use-after-free accesses in msdc_request_done() and msdc_recheck_sdio_irq(). The fix involves calling cancel_delayed_work_sync() after mmc_remove_host() to ensure that the timeout callback is properly canceled, preventing use-after-free accesses and potential system instability. The vulnerability can be mitigated by applying the patch and verifying the Linux kernel version.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch to ensure the cancel_delayed_work_sync() function is called after mmc_remove_host()
• Verify the Linux kernel version and apply updates as necessary
• Monitor system logs for signs of use-after-free accesses
• Perform a thorough review of the system's configuration and ensure that all necessary security patches are applied
• Check for any potential exposure of sensitive data due to the vulnerability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was reported by KASAN, which detected use-after-free accesses in msdc_request_done() and msdc_recheck_sdio_irq(). The issue was resolved by modifying the driver to call cancel_delayed_work_sync() after mmc_remove_host(). The fix ensures that the request timeout work is canceled before the host resources are released, preventing potential use-after-free accesses and system instability. The source confidence is limited to the provided KASAN report and the vendor's patch notes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.