CVE-2026-98884

Что произошло

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Add validation for host-provided max_segs The max_segs field is of type unsigned short, and if a host driver sets an excessively large value, it may be truncated to zero. This can cause mmc_alloc_sg() to call kmalloc_objs() with a zero size allocation request, which leads to undefined behavior. Under the SLUB allocator, kmalloc(0) returns a special pointer (ZERO_SIZE_PTR). The subsequent 'if (sg)' check will evaluate to true, and sg_init_table() will then attempt to access invalid memory, resulting in a crash: dwmmc_rockchip 2a310000.mmc: Successfully tuned phase to 133 mmc1: new UHS-I speed SDR104 SDHC card at address aaaa Unable to handle kernel paging request at virtual address 0000001ffffffff0 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000102c88000 [0000001ffffffff0] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 2 UID: 0 PID: 102 Comm: kworker/2:1 Not tainted 7.0.0-rc6-next-20260331-00013-g4d93c25963c5-dirty #80 PREEMPT Hardware name: Rockchip RK3576 EVB V10 Board (DT) Workqueue: events_freezable mmc_rescan pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : sg_init_table+0x2c/0x50 lr : sg_init_table+0x24/0x50 sp : ffff8000837db710 x29: ffff8000837db710 x28: 000000000000c000 x27: 0000000000000300 x26: 0000000000000000 x25: 0000000000000040 x24: ffff0000c46a0000 x23: 0000000000000000 x22: ffff0000c0c73c00 x21: 0000000000000010 x20: 0000000000000010 x19: 0000000000000000 x18: 000000000000002c x17: 0000000000000000 x16: 0000000000000001 x15: 0000000000000000 x14: 0000000000000400 x13: ffff8000837dc000 x12: 0000000000000000 x11: ffff0000c0c73ca0 x10: 0000000000000040 x9 : 459ec1f0abbdbb00 x8 : 0000001fffffffe0 x7 : 0000000000000000 x6 : 000000000000003f x5 : 0000000000035579 x4 : 0000000000000901 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000010 Call trace: sg_init_table+0x2c/0x50 (P) mmc_mq_init_request+0x64/0x90 blk_mq_alloc_map_and_rqs+0x3ac/0x480 blk_mq_alloc_set_map_and_rqs+0x98/0x1e0 blk_mq_alloc_tag_set+0x1c0/0x290 mmc_init_queue+0x120/0x370 mmc_blk_alloc_req+0x150/0x420 To prevent this, add a validation check in mmc_mq_init_request() to detect when sg_len (derived from max_segs) is zero. If sg_len is zero, we return an error and print an error message, allowing host driver developers to identify and fix incorrect max_segs configuration. This is a defensive measure that ensures the MMC core fails gracefully when host drivers provide invalid max_segs values, rather than crashing with a page fault.

Что делать

dpkg-query -W -f='${Package}	${Version}\n'

rpm -qa --qf '%{NAME}\t%{VERSION}-%{RELEASE}\n'

Get-HotFix | Select-Object HotFixID, InstalledOn

Продукты и затронутые версии

{
  "status": "affected",
  "version": "05e5b136459b11cd9559370d5756719e08074fe0",
  "lessThan": "03f5a16ec85beebabd5ab5e67ac1527f87908ded",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "05e5b136459b11cd9559370d5756719e08074fe0",
  "lessThan": "c465608bd25d7f8565be7817a6a36a5d69f8aa14",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "05e5b136459b11cd9559370d5756719e08074fe0",
  "lessThan": "a8283f7d93f0d9336b15618b9665279ff6944319",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "05e5b136459b11cd9559370d5756719e08074fe0",
  "lessThan": "9cca3c0c1472d6204ef8a78a6e7b3afe9610b22e",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "05e5b136459b11cd9559370d5756719e08074fe0",
  "lessThan": "b037c2f7794aa01ee2a00e43c29645fd2dd2dfb9",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "05e5b136459b11cd9559370d5756719e08074fe0",
  "lessThan": "3e0483e93a8be320f70a1ff68d835f7f015af311",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "2.6.24"
}

{
  "status": "unaffected",
  "version": "0",
  "lessThan": "2.6.24",
  "versionType": "semver"
}

{
  "status": "unaffected",
  "version": "5.15.222",
  "versionType": "semver",
  "lessThanOrEqual": "5.15.*"
}

{
  "status": "unaffected",
  "version": "6.1.189",
  "versionType": "semver",
  "lessThanOrEqual": "6.1.*"
}

{
  "status": "unaffected",
  "version": "6.6.158",
  "versionType": "semver",
  "lessThanOrEqual": "6.6.*"
}

{
  "status": "unaffected",
  "version": "6.12.111",
  "versionType": "semver",
  "lessThanOrEqual": "6.12.*"
}

{
  "status": "unaffected",
  "version": "6.18.53",
  "versionType": "semver",
  "lessThanOrEqual": "6.18.*"
}

{
  "status": "unaffected",
  "version": "7.2",
  "versionType": "original_commit_for_fix",
  "lessThanOrEqual": "*"
}

CVSS: оценки и векторы

Оценка CVSS отсутствует.

Источники и ссылки

{
  "cwes": [],
  "epss": {
    "source": "epss",
    "received_at": "2026-11-01T21:13:22.691371+00:00"
  },
  "title": {
    "source": "cve",
    "received_at": "2026-10-28T20:15:08.455736+00:00"
  },
  "scores": [],
  "status": {
    "source": "cve",
    "received_at": "2026-10-28T20:15:08.455736+00:00"
  },
  "affected": [
    "cve"
  ],
  "published": {
    "source": "cve",
    "received_at": "2026-10-28T20:15:08.455736+00:00"
  },
  "solutions": [],
  "percentile": {
    "source": "epss",
    "received_at": "2026-11-01T21:13:22.691371+00:00"
  },
  "references": [
    "cve"
  ],
  "description": {
    "source": "cve",
    "received_at": "2026-10-28T20:15:08.455736+00:00"
  },
  "workarounds": [],
  "configurations": []
}

Хронология записи

1. Данные обновлены02.11.2026, 00:13
2. Данные обновлены31.10.2026, 12:00
3. Данные обновлены29.10.2026, 12:47
4. Опубликована28.10.2026, 23:15

Личная заметка и статус

Другие CVE того же продукта