CVE-2026-98212: linux

CVSS: UnknownReceived
AliasesUBUNTU-CVE-2026-98212DEBIAN-CVE-2026-98212
Published 06-10-2026Last modified 19-10-2026
Open JSON

Vulnerability summary

CVE-2026-98212 is a vulnerability in linux with no CVSS score yet. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.4% of scored vulnerabilities.

Overall risk
0/100
0100
Minimal · default modelHow is this calculated?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
0.21%
0%100%
Low · Change unavailable
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
OPENSUSE-SU-2026:12131-1

Timeline

  1. 06-10-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: mmc: hsq: Fix use-after-free in retry work mmc_hsq_pump_requests() queues retry_work when request_atomic() returns -EBUSY; today sdhci-sprd is the only consumer that implements request_atomic(). The work is embedded in a devm-allocated mmc_hsq, but is never cancelled during driver removal. Work still pending at unbind can therefore run after the devm allocation has been released and dereference hsq->mmc and hsq->mrq. Use devm_work_autocancel() to cancel and drain retry_work before the devm allocation is released. By the time devres cleanup begins, mmc_remove_host() has already stopped the host, so no new requests can arm the work. This issue was found by an in-house static analysis tool.

CVSS metrics

Risk metrics not yet published.

EPSS trend

Probability

0.21%

Chance of exploitation in the next 30 days

Percentile

10%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

06-10-202621-10-2026
EPSS score
0.21%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu157 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian1 product
  • linuxAll versions (No fix recorded) | < 6.12.113-1 | < 7.2.8-1
Linux1 product
  • linux≥ 6db96e5810e0a6a345b7d78549de7676ae5b2662, < c50d6515bffb148c2c12be6d587ec201dfab4c34 | ≥ 6db96e5810e0a6a345b7d78549de7676ae5b2662, < df2eb59fd9eb33663dc1053f5a4ed851e0aa1f67 | ≥ 6db96e5810e0a6a345b7d78549de7676ae5b2662, < 8439bf262ce3267bcfee29d3c61605f1731a2271 | ≥ 6db96e5810e0a6a345b7d78549de7676ae5b2662, < 45341b341642c377192c95e4d48e0a859cf85f42 | ≥ 6db96e5810e0a6a345b7d78549de7676ae5b2662, < 5d132990475f02cfa1debe03d50b479432864ebd | 5.8

3 vendors · 159 products

References

9 links