# CVE-2026-98884: mmc: core: Add validation for host-provided max_segs

CVE-2026-98884 is fixed in 30 products on 1 platform, first by DEBIAN-CVE-2026-98884, released October 24, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-98884
- Priority: Routine
- CVSS: 5.5 (Moderate)
- EPSS: 0.0019
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 23, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98884

## Description

In the Linux kernel, the following vulnerability has been resolved:  mmc: core: Add validation for host-provided max_segs  The max_segs field is of type unsigned short, and if a host driver sets an excessively large value, it may be truncated to zero. This can cause mmc_alloc_sg() to call kmalloc_objs() with a zero size allocation request, which leads to undefined behavior.  Under the SLUB allocator, kmalloc(0) returns a special pointer (ZERO_SIZE_PTR). The subsequent 'if (sg)' check will evaluate to true, and sg_init_table() will then attempt to access invalid memory, resulting in a crash:  dwmmc_rockchip 2a310000.mmc: Successfully tuned phase to 133 mmc1: new UHS-I speed SDR104 SDHC card at address aaaa Unable to handle kernel paging request at virtual address 0000001ffffffff0 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000102c88000 [0000001ffffffff0] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 2 UID: 0 PID: 102 Comm: kworker/2:1 Not tainted 7.0.0-rc6-next-20260331-00013-g4d93c25963c5-dirty #80 PREEMPT Hardware name: Rockchip RK3576 EVB V10 Board (DT) Workqueue: events_freezable mmc_rescan pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : sg_init_table+0x2c/0x50 lr : sg_init_table+0x24/0x50 sp : ffff8000837db710 x29: ffff8000837db710 x28: 000000000000c000 x27: 0000000000000300 x26: 0000000000000000 x25: 0000000000000040 x24: ffff0000c46a0000 x23: 0000000000000000 x22: ffff0000c0c73c00 x21: 0000000000000010 x20: 0000000000000010 x19: 0000000000000000 x18: 000000000000002c x17: 0000000000000000 x16: 0000000000000001 x15: 0000000000000000 x14: 0000000000000400 x13: ffff8000837dc000 x12: 0000000000000000 x11: ffff0000c0c73ca0 x10: 0000000000000040 x9 : 459ec1f0abbdbb00 x8 : 0000001fffffffe0 x7 : 0000000000000000 x6 : 000000000000003f x5 : 0000000000035579 x4 : 0000000000000901 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000010 Call trace: sg_init_table+0x2c/0x50 (P) mmc_mq_init_request+0x64/0x90 blk_mq_alloc_map_and_rqs+0x3ac/0x480 blk_mq_alloc_set_map_and_rqs+0x98/0x1e0 blk_mq_alloc_tag_set+0x1c0/0x290 mmc_init_queue+0x120/0x370 mmc_blk_alloc_req+0x150/0x420  To prevent this, add a validation check in mmc_mq_init_request() to detect when sg_len (derived from max_segs) is zero. If sg_len is zero, we return an error and print an error message, allowing host driver developers to identify and fix incorrect max_segs configuration.  This is a defensive measure that ensures the MMC core fails gracefully when host drivers provide invalid max_segs values, rather than crashing with a page fault.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | bpftool ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | bpftool ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-64kb sles 15.7 | 6.4.0-150700.53.90.1 | [SUSE-SU-2026:5091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5091-1.md) | Nov 7, 2026 |
| Linux | kernel-azure sles 15.7 | 6.4.0-150700.53.90.1 | [SUSE-SU-2026:5091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5091-1.md) | Nov 7, 2026 |
| Linux | kernel-default sles 15.7 | 6.4.0-150700.53.90.1 | [SUSE-SU-2026:5091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5091-1.md) | Nov 7, 2026 |
| Linux | kernel-default-base sles 15.7 | 6.4.0-150700.53.90.1.150700.17.51.1 | [SUSE-SU-2026:5091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5091-1.md) | Nov 7, 2026 |
| Linux | kernel-docs sles 15.7 | 6.4.0-150700.53.90.1 | [SUSE-SU-2026:5091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5091-1.md) | Nov 7, 2026 |
| Linux | kernel-livepatch-SLE15-SP7_Update_24 sles 15.7 | 1-150700.15.3.1 | [SUSE-SU-2026:5091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5091-1.md) | Nov 7, 2026 |
| Linux | kernel-obs-build sles 15.7 | 6.4.0-150700.53.90.1 | [SUSE-SU-2026:5091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5091-1.md) | Nov 7, 2026 |
| Linux | kernel-source sles 15.7 | 6.4.0-150700.53.90.1 | [SUSE-SU-2026:5091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5091-1.md) | Nov 7, 2026 |
| Linux | kernel-syms sles 15.7 | 6.4.0-150700.53.90.1 | [SUSE-SU-2026:5091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5091-1.md) | Nov 7, 2026 |
| Linux | kernel-uek ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek-container ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek-container ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek-container-debug ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek-container-debug ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek-core ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek-core ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek-debug ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek-debug ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek-debug-core ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek-debug-core ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek-debug-devel ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek-debug-devel ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek-debug-modules ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek-debug-modules ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek-debug-modules-extra ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek-debug-modules-extra ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek-devel ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek-devel ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek-doc ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek-doc ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek-modules ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek-modules ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek-modules-extra ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek-modules-extra ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek64k ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek64k ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek64k-core ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek64k-core ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek64k-devel ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek64k-devel ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek64k-modules ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek64k-modules ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek64k-modules-extra ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-uek64k-modules-extra ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 |
| Linux | kernel-zfcpdump sles 15.7 | 6.4.0-150700.53.90.1 | [SUSE-SU-2026:5091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5091-1.md) | Nov 7, 2026 |
| Linux | linux Debian 12.15 (bookworm) | 6.1.190-1 | [DEBIAN-CVE-2026-98884](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98884.md) | Oct 24, 2026 |
| Linux | linux Debian 13.5 (trixie) | 6.12.111-1 | [DEBIAN-CVE-2026-98884](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98884.md) | Oct 24, 2026 |
| Linux | linux Debian 14 | 7.2.6-1 | [DEBIAN-CVE-2026-98884](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98884.md) | Oct 24, 2026 |

---

Data as of 2026-11-09T07:25:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.