Executive brief
A race condition was identified in the Linux kernel's MultiMediaCard (MMC) subsystem, which manages communication with SD cards and similar storage devices. Under specific timing conditions, internal status flags could be incorrectly overwritten, potentially leading to system warnings or unexpected behavior during data transfers. This issue has been resolved by separating these status flags to prevent them from interfering with each other during simultaneous operations.
Technical details
The vulnerability is a race condition caused by non-atomic read-modify-write (RMW) operations on bitfields within the 'mmc_host' structure. Specifically, the 'claimed' bit shared a memory word with several retune control flags ('can_retune', 'retune_now', 'retune_paused'). When concurrent updates occurred in different asynchronous contexts—such as __mmc_claim_host() and mmc_mq_queue_rq()—writes to one flag could inadvertently overwrite others. This resulted in side effects like spurious WARN_ON(!host->claimed) triggers. The fix involves converting these bitfield members into independent boolean types to ensure memory isolation and prevent shared-word coupling.
Affected products
- Linux Linux Kernel All versions prior to the fix (including various stable branches like 5.x, 6.x)
Timeline
- 2026-02-19: other: Patch authored by Penghe Geng
- 2026-05-13: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0e06cc511c61cff1591e5435a207759adcc76b6d
- https://git.kernel.org/stable/c/270277c2ab631044867adb1bd2f2433d3892de6e
- https://git.kernel.org/stable/c/41dce4dae583a8ce06a7ebf4ce704c46a142957c
- https://git.kernel.org/stable/c/45038e03f15e992c48603fff8c6b1c9be5397ac9
- https://git.kernel.org/stable/c/901084c51a0a8fb42a3f37d2e9c62083c495f824
- https://git.kernel.org/stable/c/bb7fc2498c3bb25fa6a91f22f4760005325cfbd5
- https://git.kernel.org/stable/c/d3a3caf44c8ec26f5d63dc17c1c7242effa60ebc