In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues req_timeout… (CVE-2026-99035)

The Linux kernel vulnerability (CVE-2026-99035) concerns the mtk-sd driver queuing a request timeout while a request is active. The msdc_request_done() function uses cancel_delayed_work(), which does not wait for a timeout callback already in progress. This callback calls mmc_request_done(), waking the request waiter, then continues to access host resources that may have been freed during device unbind in msdc_drv_remove(). This leads to use-after-free conditions detected by KASAN. The fix involves calling cancel_delayed_work_sync() after mmc_remove_host() stops new requests and before releasing host resources, preventing the callback from accessing freed memory.

The vulnerability causes use-after-free memory access in the kernel, which can lead to kernel memory corruption and potential system instability or crashes. It was detected by kernel address sanitizer (KASAN) during unbind tests. There is no indication of known exploitation in the wild.

A fix is available that properly synchronizes cancellation of delayed work during device removal by using cancel_delayed_work_sync(). Users should update to a Linux kernel version that includes this fix. No additional mitigation is indicated.