From: Fan Wu <fanwu01@zju.edu.cn> stable inclusion from stable-v6.6.158 commit 0bf3d168a2cc20b120d6b50f0a8ac5b40ff4d589 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19959 CVE: CVE-2026-98213 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- commit 6feadbecdae60a6324c967f3b1493741083793a3 upstream. A host controller that uses sdio_signal_irq() schedules host->sdio_irq_work from its interrupt handler. That work is only cancelled on the suspend path (mmc_sdio_suspend()), not on the remove/free path, so a worker armed just before the controller freed its IRQ can run after mmc_host_classdev_release() has freed the host and dereference it through container_of(). Cancel host->sdio_irq_work in mmc_free_host(), like the existing host->detect drain added by commit 1036f69e2513 ("mmc: core: Cancel delayed work before releasing host"). This issue was found by an in-house static analysis tool. Fixes: 682696605c70 ("mmc: sdio: Add API to manage SDIO IRQs from a workqueue") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu <fanwu01@zju.edu.cn> Signed-off-by: Ulf Hansson <ulfh@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Conflicts: drivers/mmc/core/host.c [In OLK-5.10 host->sdio_irq_work is still a struct delayed_work as in linux-5.10.y, while the 6.6.y patch targets struct work_struct; adapted cancel_work_sync() to cancel_delayed_work_sync(), matching the type and the existing suspend-path call in sdio.c] Signed-off-by: Lu Jialin <lujialin4@huawei.com> --- drivers/mmc/core/host.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c index b949a4468bf5..040e9c417a5e 100644 --- a/drivers/mmc/core/host.c +++ b/drivers/mmc/core/host.c @@ -613,6 +613,7 @@ EXPORT_SYMBOL(mmc_remove_host); void mmc_free_host(struct mmc_host *host) { cancel_delayed_work_sync(&host->detect); + cancel_delayed_work_sync(&host->sdio_irq_work); mmc_pwrseq_free(host); put_device(&host->class_dev); } -- 2.34.1