In the Linux kernel, the following vulnerability has been resolved: mmc: core: Add validation for host-provided max_segs The max_segs field is of… (CVE-2026-98884)

The Linux kernel MMC core had a vulnerability where the max_segs field, an unsigned short, could be set by a host driver to a value so large that it truncated to zero. This zero value caused mmc_alloc_sg() to call kmalloc_objs() with a zero size allocation, which under the SLUB allocator returns a special pointer (ZERO_SIZE_PTR). Subsequent code incorrectly treated this pointer as valid and accessed invalid memory, causing a kernel crash (page fault). The issue was fixed by adding validation in mmc_mq_init_request() to detect when sg_len derived from max_segs is zero, returning an error and logging a message to prevent the crash and help developers fix the host driver configuration.

If exploited, this vulnerability causes a kernel crash (denial of service) due to invalid memory access triggered by a zero-size allocation. It affects the stability of the system running the vulnerable Linux kernel MMC core when a host driver sets an invalid max_segs value. There is no indication of privilege escalation or data corruption beyond the crash.

A fix is available that adds validation to the MMC core to detect invalid zero sg_len values derived from max_segs and returns an error instead of proceeding. Systems should apply the official Linux kernel patch that includes this validation. No other mitigation is indicated.