{
  "cveId": "CVE-2026-98884",
  "url": "https://patchblox.com/security/cve/CVE-2026-98884",
  "summary": "CVE-2026-98884 is fixed in 30 products on 1 platform, first by DEBIAN-CVE-2026-98884, released October 24, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "mmc: core: Add validation for host-provided max_segs",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  mmc: core: Add validation for host-provided max_segs  The max_segs field is of type unsigned short, and if a host driver sets an excessively large value, it may be truncated to zero. This can cause mmc_alloc_sg() to call kmalloc_objs() with a zero size allocation request, which leads to undefined behavior.  Under the SLUB allocator, kmalloc(0) returns a special pointer (ZERO_SIZE_PTR). The subsequent \u0027if (sg)\u0027 check will evaluate to true, and sg_init_table() will then attempt to access invalid memory, resulting in a crash:  dwmmc_rockchip 2a310000.mmc: Successfully tuned phase to 133 mmc1: new UHS-I speed SDR104 SDHC card at address aaaa Unable to handle kernel paging request at virtual address 0000001ffffffff0 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000102c88000 [0000001ffffffff0] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 2 UID: 0 PID: 102 Comm: kworker/2:1 Not tainted 7.0.0-rc6-next-20260331-00013-g4d93c25963c5-dirty #80 PREEMPT Hardware name: Rockchip RK3576 EVB V10 Board (DT) Workqueue: events_freezable mmc_rescan pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : sg_init_table\u002B0x2c/0x50 lr : sg_init_table\u002B0x24/0x50 sp : ffff8000837db710 x29: ffff8000837db710 x28: 000000000000c000 x27: 0000000000000300 x26: 0000000000000000 x25: 0000000000000040 x24: ffff0000c46a0000 x23: 0000000000000000 x22: ffff0000c0c73c00 x21: 0000000000000010 x20: 0000000000000010 x19: 0000000000000000 x18: 000000000000002c x17: 0000000000000000 x16: 0000000000000001 x15: 0000000000000000 x14: 0000000000000400 x13: ffff8000837dc000 x12: 0000000000000000 x11: ffff0000c0c73ca0 x10: 0000000000000040 x9 : 459ec1f0abbdbb00 x8 : 0000001fffffffe0 x7 : 0000000000000000 x6 : 000000000000003f x5 : 0000000000035579 x4 : 0000000000000901 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000010 Call trace: sg_init_table\u002B0x2c/0x50 (P) mmc_mq_init_request\u002B0x64/0x90 blk_mq_alloc_map_and_rqs\u002B0x3ac/0x480 blk_mq_alloc_set_map_and_rqs\u002B0x98/0x1e0 blk_mq_alloc_tag_set\u002B0x1c0/0x290 mmc_init_queue\u002B0x120/0x370 mmc_blk_alloc_req\u002B0x150/0x420  To prevent this, add a validation check in mmc_mq_init_request() to detect when sg_len (derived from max_segs) is zero. If sg_len is zero, we return an error and print an error message, allowing host driver developers to identify and fix incorrect max_segs configuration.  This is a defensive measure that ensures the MMC core fails gracefully when host drivers provide invalid max_segs values, rather than crashing with a page fault.",
  "published": "2026-10-23T12:18:22Z",
  "severity": "Moderate",
  "cvss": 5.5,
  "epss": 0.00187,
  "epssPercentile": 0.08327,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98884",
  "fixes": [
    {
      "platform": "linux",
      "product": "bpftool",
      "release": "ol 8",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "bpftool",
      "release": "ol 9",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-64kb",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-azure",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-default",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-default-base",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1.150700.17.51.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-docs",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-livepatch-SLE15-SP7_Update_24",
      "release": "sles 15.7",
      "fixedVersion": "1-150700.15.3.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-obs-build",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-source",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-syms",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek",
      "release": "ol 8",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek",
      "release": "ol 9",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-container",
      "release": "ol 8",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-container",
      "release": "ol 9",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-container-debug",
      "release": "ol 8",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-container-debug",
      "release": "ol 9",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-core",
      "release": "ol 8",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-core",
      "release": "ol 9",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-debug",
      "release": "ol 8",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-debug",
      "release": "ol 9",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-debug-core",
      "release": "ol 8",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-debug-core",
      "release": "ol 9",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-debug-devel",
      "release": "ol 8",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-debug-devel",
      "release": "ol 9",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-debug-modules",
      "release": "ol 8",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-debug-modules",
      "release": "ol 9",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-debug-modules-extra",
      "release": "ol 8",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-debug-modules-extra",
      "release": "ol 9",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-devel",
      "release": "ol 8",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-devel",
      "release": "ol 9",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-doc",
      "release": "ol 8",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-doc",
      "release": "ol 9",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-modules",
      "release": "ol 8",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-modules",
      "release": "ol 9",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-modules-extra",
      "release": "ol 8",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-modules-extra",
      "release": "ol 9",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek64k",
      "release": "ol 8",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek64k",
      "release": "ol 9",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek64k-core",
      "release": "ol 8",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek64k-core",
      "release": "ol 9",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek64k-devel",
      "release": "ol 8",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek64k-devel",
      "release": "ol 9",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek64k-modules",
      "release": "ol 8",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek64k-modules",
      "release": "ol 9",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek64k-modules-extra",
      "release": "ol 8",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek64k-modules-extra",
      "release": "ol 9",
      "fixedVersion": "0:5.15.0-326.222.4.el9uek",
      "fix": "ELSA-2026-500574",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500574",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-zfcpdump",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.90.1",
      "fix": "SUSE-SU-2026:5091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.190-1",
      "fix": "DEBIAN-CVE-2026-98884",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98884",
      "released": "2026-10-24T13:25:57Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.111-1",
      "fix": "DEBIAN-CVE-2026-98884",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98884",
      "released": "2026-10-24T13:25:57Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.6-1",
      "fix": "DEBIAN-CVE-2026-98884",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98884",
      "released": "2026-10-24T13:25:57Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T07:25:28Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}