VulnerabilityPublished 6 Oct 2026Updated 19 Oct 2026

CVE-2026-98207: Linux kernel · mmc: spi: reset bytes_xfered before retrying CRC failures

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in da4929ee78ee701c3717543840798fedff66c430 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 14:05 UTC

Severity

Low

Rated Low by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in da4929ee78ee701c3717543840798fedff66c430, d1acf4b9f6e9697406ce84ee9acfb92e094d5c7a, 4885e587f1afa9e1a573ab66f8c4d94d7b836d86 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 6 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 061c6c847eeb11743e489a16e907b41c6f9042b6, < da4929ee78ee701c3717543840798fedff66c430	Fixed in da4929ee78ee701c3717543840798fedff66c430
LinuxLinux	Affected ≥ 061c6c847eeb11743e489a16e907b41c6f9042b6, < d1acf4b9f6e9697406ce84ee9acfb92e094d5c7a	Fixed in d1acf4b9f6e9697406ce84ee9acfb92e094d5c7a
LinuxLinux	Affected ≥ 061c6c847eeb11743e489a16e907b41c6f9042b6, < 4885e587f1afa9e1a573ab66f8c4d94d7b836d86	Fixed in 4885e587f1afa9e1a573ab66f8c4d94d7b836d86
LinuxLinux	Affected ≥ 061c6c847eeb11743e489a16e907b41c6f9042b6, < 57f5e29db63f7c80f1805d89234a74dcdbf60231	Fixed in 57f5e29db63f7c80f1805d89234a74dcdbf60231
LinuxLinux	Affected ≥ 061c6c847eeb11743e489a16e907b41c6f9042b6, < 8b0cc8707f65e0f51912e764e1b309b2559db1ec	Fixed in 8b0cc8707f65e0f51912e764e1b309b2559db1ec
LinuxLinux	Affected ≥ 061c6c847eeb11743e489a16e907b41c6f9042b6, < 7d2f0ec16b300645f20435a6c3827b15e01419af	Fixed in 7d2f0ec16b300645f20435a6c3827b15e01419af

AI-suggested

A fix has been implemented in the Linux kernel to clear the bytes transferred counter before retrying CRC-failed data requests in the MMC SPI driver. Users should update to a Linux kernel version that includes the fix identified by the commits listed in the established facts. No additional mitigation is required beyond applying the official patch.

Description

A vulnerability in the Linux kernel's MMC SPI driver caused incorrect accounting of transferred bytes after retrying data block transfers that failed CRC checks. Specifically, the bytes transferred counter was not reset before retrying, leading to an over-reporting of bytes completed in multi-block requests. This issue affects MMC-over-SPI systems during multi-block transfers encountering CRC errors.

Impact

The vulnerability causes inaccurate reporting of the number of bytes transferred in MMC-over-SPI multi-block data requests after CRC error retries. While the data itself is correctly retried and transferred, the completion accounting may overstate the amount of data transferred, which could affect software relying on this metric for correctness or resource management. There is no indication of data corruption or security compromise beyond incorrect accounting.

Summary

The Linux kernel's mmc_spi_data_do() function updates the bytes transferred counter after each successfully transferred block. If a later block fails with a CRC error, the retry mechanism in mmc_spi_request() does not reset this counter before retrying the data request. Consequently, when the retry succeeds, the total bytes transferred reported can exceed the actual bytes transferred, potentially surpassing the request size. This flaw affects multi-block MMC-over-SPI transfers where CRC errors occur but are internally retried successfully. The fix involves clearing the bytes transferred counter along with the error before retrying, ensuring accurate completion reporting.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 12:23 UTC

Technical details

References

Community reviews

Related threats