{"api_version":"1","generated_at":"2026-10-24T13:18:36+00:00","cve":"CVE-2026-98884","urls":{"html":"https://cve.report/CVE-2026-98884","api":"https://cve.report/api/cve/CVE-2026-98884.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-98884","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-98884"},"summary":{"title":"mmc: core: Add validation for host-provided max_segs","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: core: Add validation for host-provided max_segs\n\nThe max_segs field is of type unsigned short, and if a host driver\nsets an excessively large value, it may be truncated to zero. This\ncan cause mmc_alloc_sg() to call kmalloc_objs() with a zero size\nallocation request, which leads to undefined behavior.\n\nUnder the SLUB allocator, kmalloc(0) returns a special pointer\n(ZERO_SIZE_PTR). The subsequent 'if (sg)' check will evaluate to\ntrue, and sg_init_table() will then attempt to access invalid memory,\nresulting in a crash:\n\ndwmmc_rockchip 2a310000.mmc: Successfully tuned phase to 133\nmmc1: new UHS-I speed SDR104 SDHC card at address aaaa\nUnable to handle kernel paging request at virtual address 0000001ffffffff0\nMem abort info:\nESR = 0x0000000096000004\nEC = 0x25: DABT (current EL), IL = 32 bits\nSET = 0, FnV = 0\nEA = 0, S1PTW = 0\nFSC = 0x04: level 0 translation fault\nData abort info:\nISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\nCM = 0, WnR = 0, TnD = 0, TagAccess = 0\nGCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\nuser pgtable: 4k pages, 48-bit VAs, pgdp=0000000102c88000\n[0000001ffffffff0] pgd=0000000000000000, p4d=0000000000000000\nInternal error: Oops: 0000000096000004 [#1] SMP\nModules linked in:\nCPU: 2 UID: 0 PID: 102 Comm: kworker/2:1 Not tainted 7.0.0-rc6-next-20260331-00013-g4d93c25963c5-dirty #80 PREEMPT\nHardware name: Rockchip RK3576 EVB V10 Board (DT)\nWorkqueue: events_freezable mmc_rescan\npstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : sg_init_table+0x2c/0x50\nlr : sg_init_table+0x24/0x50\nsp : ffff8000837db710\nx29: ffff8000837db710 x28: 000000000000c000 x27: 0000000000000300\nx26: 0000000000000000 x25: 0000000000000040 x24: ffff0000c46a0000\nx23: 0000000000000000 x22: ffff0000c0c73c00 x21: 0000000000000010\nx20: 0000000000000010 x19: 0000000000000000 x18: 000000000000002c\nx17: 0000000000000000 x16: 0000000000000001 x15: 0000000000000000\nx14: 0000000000000400 x13: ffff8000837dc000 x12: 0000000000000000\nx11: ffff0000c0c73ca0 x10: 0000000000000040 x9 : 459ec1f0abbdbb00\nx8 : 0000001fffffffe0 x7 : 0000000000000000 x6 : 000000000000003f\nx5 : 0000000000035579 x4 : 0000000000000901 x3 : 0000000000000000\nx2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000010\nCall trace:\nsg_init_table+0x2c/0x50 (P)\nmmc_mq_init_request+0x64/0x90\nblk_mq_alloc_map_and_rqs+0x3ac/0x480\nblk_mq_alloc_set_map_and_rqs+0x98/0x1e0\nblk_mq_alloc_tag_set+0x1c0/0x290\nmmc_init_queue+0x120/0x370\nmmc_blk_alloc_req+0x150/0x420\n\nTo prevent this, add a validation check in mmc_mq_init_request() to\ndetect when sg_len (derived from max_segs) is zero. If sg_len is zero,\nwe return an error and print an error message, allowing host driver\ndevelopers to identify and fix incorrect max_segs configuration.\n\nThis is a defensive measure that ensures the MMC core fails gracefully\nwhen host drivers provide invalid max_segs values, rather than crashing\nwith a page fault.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-10-23 12:18:22","updated_at":"2026-10-23 12:18:22"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/c465608bd25d7f8565be7817a6a36a5d69f8aa14","name":"https://git.kernel.org/stable/c/c465608bd25d7f8565be7817a6a36a5d69f8aa14","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b037c2f7794aa01ee2a00e43c29645fd2dd2dfb9","name":"https://git.kernel.org/stable/c/b037c2f7794aa01ee2a00e43c29645fd2dd2dfb9","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/03f5a16ec85beebabd5ab5e67ac1527f87908ded","name":"https://git.kernel.org/stable/c/03f5a16ec85beebabd5ab5e67ac1527f87908ded","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/3e0483e93a8be320f70a1ff68d835f7f015af311","name":"https://git.kernel.org/stable/c/3e0483e93a8be320f70a1ff68d835f7f015af311","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a8283f7d93f0d9336b15618b9665279ff6944319","name":"https://git.kernel.org/stable/c/a8283f7d93f0d9336b15618b9665279ff6944319","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/9cca3c0c1472d6204ef8a78a6e7b3afe9610b22e","name":"https://git.kernel.org/stable/c/9cca3c0c1472d6204ef8a78a6e7b3afe9610b22e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98884","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98884","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 03f5a16ec85beebabd5ab5e67ac1527f87908ded git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 c465608bd25d7f8565be7817a6a36a5d69f8aa14 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 a8283f7d93f0d9336b15618b9665279ff6944319 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 9cca3c0c1472d6204ef8a78a6e7b3afe9610b22e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 b037c2f7794aa01ee2a00e43c29645fd2dd2dfb9 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 3e0483e93a8be320f70a1ff68d835f7f015af311 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.15.222 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.1.189 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.6.158 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.12.111 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.18.53 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.222 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.189 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.158 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.111 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.53 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/mmc/core/queue.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"03f5a16ec85beebabd5ab5e67ac1527f87908ded","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"c465608bd25d7f8565be7817a6a36a5d69f8aa14","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"a8283f7d93f0d9336b15618b9665279ff6944319","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"9cca3c0c1472d6204ef8a78a6e7b3afe9610b22e","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"b037c2f7794aa01ee2a00e43c29645fd2dd2dfb9","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"3e0483e93a8be320f70a1ff68d835f7f015af311","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"5.15.222","status":"affected","version":"0","versionType":"semver"},{"lessThan":"6.1.189","status":"affected","version":"0","versionType":"semver"},{"lessThan":"6.6.158","status":"affected","version":"0","versionType":"semver"},{"lessThan":"6.12.111","status":"affected","version":"0","versionType":"semver"},{"lessThan":"6.18.53","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/mmc/core/queue.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.222","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.189","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.158","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.111","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.53","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.222","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.189","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.158","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.111","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.53","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: core: Add validation for host-provided max_segs\n\nThe max_segs field is of type unsigned short, and if a host driver\nsets an excessively large value, it may be truncated to zero. This\ncan cause mmc_alloc_sg() to call kmalloc_objs() with a zero size\nallocation request, which leads to undefined behavior.\n\nUnder the SLUB allocator, kmalloc(0) returns a special pointer\n(ZERO_SIZE_PTR). The subsequent 'if (sg)' check will evaluate to\ntrue, and sg_init_table() will then attempt to access invalid memory,\nresulting in a crash:\n\ndwmmc_rockchip 2a310000.mmc: Successfully tuned phase to 133\nmmc1: new UHS-I speed SDR104 SDHC card at address aaaa\nUnable to handle kernel paging request at virtual address 0000001ffffffff0\nMem abort info:\nESR = 0x0000000096000004\nEC = 0x25: DABT (current EL), IL = 32 bits\nSET = 0, FnV = 0\nEA = 0, S1PTW = 0\nFSC = 0x04: level 0 translation fault\nData abort info:\nISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\nCM = 0, WnR = 0, TnD = 0, TagAccess = 0\nGCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\nuser pgtable: 4k pages, 48-bit VAs, pgdp=0000000102c88000\n[0000001ffffffff0] pgd=0000000000000000, p4d=0000000000000000\nInternal error: Oops: 0000000096000004 [#1] SMP\nModules linked in:\nCPU: 2 UID: 0 PID: 102 Comm: kworker/2:1 Not tainted 7.0.0-rc6-next-20260331-00013-g4d93c25963c5-dirty #80 PREEMPT\nHardware name: Rockchip RK3576 EVB V10 Board (DT)\nWorkqueue: events_freezable mmc_rescan\npstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : sg_init_table+0x2c/0x50\nlr : sg_init_table+0x24/0x50\nsp : ffff8000837db710\nx29: ffff8000837db710 x28: 000000000000c000 x27: 0000000000000300\nx26: 0000000000000000 x25: 0000000000000040 x24: ffff0000c46a0000\nx23: 0000000000000000 x22: ffff0000c0c73c00 x21: 0000000000000010\nx20: 0000000000000010 x19: 0000000000000000 x18: 000000000000002c\nx17: 0000000000000000 x16: 0000000000000001 x15: 0000000000000000\nx14: 0000000000000400 x13: ffff8000837dc000 x12: 0000000000000000\nx11: ffff0000c0c73ca0 x10: 0000000000000040 x9 : 459ec1f0abbdbb00\nx8 : 0000001fffffffe0 x7 : 0000000000000000 x6 : 000000000000003f\nx5 : 0000000000035579 x4 : 0000000000000901 x3 : 0000000000000000\nx2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000010\nCall trace:\nsg_init_table+0x2c/0x50 (P)\nmmc_mq_init_request+0x64/0x90\nblk_mq_alloc_map_and_rqs+0x3ac/0x480\nblk_mq_alloc_set_map_and_rqs+0x98/0x1e0\nblk_mq_alloc_tag_set+0x1c0/0x290\nmmc_init_queue+0x120/0x370\nmmc_blk_alloc_req+0x150/0x420\n\nTo prevent this, add a validation check in mmc_mq_init_request() to\ndetect when sg_len (derived from max_segs) is zero. If sg_len is zero,\nwe return an error and print an error message, allowing host driver\ndevelopers to identify and fix incorrect max_segs configuration.\n\nThis is a defensive measure that ensures the MMC core fails gracefully\nwhen host drivers provide invalid max_segs values, rather than crashing\nwith a page fault."}],"providerMetadata":{"dateUpdated":"2026-10-23T11:37:39.893Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/03f5a16ec85beebabd5ab5e67ac1527f87908ded"},{"url":"https://git.kernel.org/stable/c/c465608bd25d7f8565be7817a6a36a5d69f8aa14"},{"url":"https://git.kernel.org/stable/c/a8283f7d93f0d9336b15618b9665279ff6944319"},{"url":"https://git.kernel.org/stable/c/9cca3c0c1472d6204ef8a78a6e7b3afe9610b22e"},{"url":"https://git.kernel.org/stable/c/b037c2f7794aa01ee2a00e43c29645fd2dd2dfb9"},{"url":"https://git.kernel.org/stable/c/3e0483e93a8be320f70a1ff68d835f7f015af311"}],"title":"mmc: core: Add validation for host-provided max_segs","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-98884","datePublished":"2026-10-23T11:37:39.893Z","dateReserved":"2026-09-25T10:25:14.378Z","dateUpdated":"2026-10-23T11:37:39.893Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-23 12:18:22","lastModifiedDate":"2026-10-23 12:18:22","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"98884","Ordinal":"1","Title":"mmc: core: Add validation for host-provided max_segs","CVE":"CVE-2026-98884","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"98884","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: core: Add validation for host-provided max_segs\n\nThe max_segs field is of type unsigned short, and if a host driver\nsets an excessively large value, it may be truncated to zero. This\ncan cause mmc_alloc_sg() to call kmalloc_objs() with a zero size\nallocation request, which leads to undefined behavior.\n\nUnder the SLUB allocator, kmalloc(0) returns a special pointer\n(ZERO_SIZE_PTR). The subsequent 'if (sg)' check will evaluate to\ntrue, and sg_init_table() will then attempt to access invalid memory,\nresulting in a crash:\n\ndwmmc_rockchip 2a310000.mmc: Successfully tuned phase to 133\nmmc1: new UHS-I speed SDR104 SDHC card at address aaaa\nUnable to handle kernel paging request at virtual address 0000001ffffffff0\nMem abort info:\nESR = 0x0000000096000004\nEC = 0x25: DABT (current EL), IL = 32 bits\nSET = 0, FnV = 0\nEA = 0, S1PTW = 0\nFSC = 0x04: level 0 translation fault\nData abort info:\nISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\nCM = 0, WnR = 0, TnD = 0, TagAccess = 0\nGCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\nuser pgtable: 4k pages, 48-bit VAs, pgdp=0000000102c88000\n[0000001ffffffff0] pgd=0000000000000000, p4d=0000000000000000\nInternal error: Oops: 0000000096000004 [#1] SMP\nModules linked in:\nCPU: 2 UID: 0 PID: 102 Comm: kworker/2:1 Not tainted 7.0.0-rc6-next-20260331-00013-g4d93c25963c5-dirty #80 PREEMPT\nHardware name: Rockchip RK3576 EVB V10 Board (DT)\nWorkqueue: events_freezable mmc_rescan\npstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : sg_init_table+0x2c/0x50\nlr : sg_init_table+0x24/0x50\nsp : ffff8000837db710\nx29: ffff8000837db710 x28: 000000000000c000 x27: 0000000000000300\nx26: 0000000000000000 x25: 0000000000000040 x24: ffff0000c46a0000\nx23: 0000000000000000 x22: ffff0000c0c73c00 x21: 0000000000000010\nx20: 0000000000000010 x19: 0000000000000000 x18: 000000000000002c\nx17: 0000000000000000 x16: 0000000000000001 x15: 0000000000000000\nx14: 0000000000000400 x13: ffff8000837dc000 x12: 0000000000000000\nx11: ffff0000c0c73ca0 x10: 0000000000000040 x9 : 459ec1f0abbdbb00\nx8 : 0000001fffffffe0 x7 : 0000000000000000 x6 : 000000000000003f\nx5 : 0000000000035579 x4 : 0000000000000901 x3 : 0000000000000000\nx2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000010\nCall trace:\nsg_init_table+0x2c/0x50 (P)\nmmc_mq_init_request+0x64/0x90\nblk_mq_alloc_map_and_rqs+0x3ac/0x480\nblk_mq_alloc_set_map_and_rqs+0x98/0x1e0\nblk_mq_alloc_tag_set+0x1c0/0x290\nmmc_init_queue+0x120/0x370\nmmc_blk_alloc_req+0x150/0x420\n\nTo prevent this, add a validation check in mmc_mq_init_request() to\ndetect when sg_len (derived from max_segs) is zero. If sg_len is zero,\nwe return an error and print an error message, allowing host driver\ndevelopers to identify and fix incorrect max_segs configuration.\n\nThis is a defensive measure that ensures the MMC core fails gracefully\nwhen host drivers provide invalid max_segs values, rather than crashing\nwith a page fault.","Type":"Description","Title":"mmc: core: Add validation for host-provided max_segs"}]}}}