CVE-2026-99035

In the Linux kernel, the following vulnerability has been resolved:

mmc: mtk-sd: Cancel request timeout work on remove

The driver queues req timeout while a request is active. msdc request done() uses cancel delayed work(), which does not wait for a timeout callback that has already started.

The timeout callback calls mmc request done(), which wakes the request waiter, and then continues to use host->dev comp and check the SDIO IRQ. During unbind, msdc drv remove() can return and the managed mmc host can be freed before the callback finishes.

KASAN reported use-after-free accesses in msdc request done() and msdc recheck sdio irq() in each of three unbind tests. The same tests completed without a kernel diagnostic after this change.

Call cancel delayed work sync() after mmc remove host() has stopped new requests and before the driver releases the host resources.