Is there a patch available for EUVD-2026-93138?

Yes, a patch is available for EUVD-2026-93138. Update the affected software to the latest version immediately.

Linux EUVD-2026-93138

| CVE-2026-98210

2026-10-06 Linux

GHSA-3899-r8v9-5w9h

Information Disclosure Linux

View

Monitor Track and reassess. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

mmc: mxcmmc: cancel data work and watchdog on remove

mxcmci_remove() frees the host through the devm tail, but neither it nor mmc_remove_host() drains the driver's own asynchronous state. host->watchdog, a 10 s timer armed on the DMA path in mxcmci_setup_data(), is deleted only by the DMA- and IRQ-complete paths, which the remove path does not explicitly drain; it can therefore fire after the host is freed and dereference it in mxcmci_watchdog(). host->datawork, armed from the IRQ handler on the PIO path, is not cancelled by the remove path either.

Free the devm-registered IRQ, then cancel datawork and delete the watchdog in mxcmci_remove(), before dma_release_channel(). Freeing the IRQ first keeps a trailing handler from re-arming datawork between the cancel and the host free. Both callbacks are non-self-rearming.

This issue was found by an in-house static analysis tool.

Affected VersionsENISA

Linux patch: 6.12.112

Linux patch: 6.1.189

Linux f6ad0a481342223b2e7ae9f55b154e14f1391ada <ae10838a7cdf0e54caa9d0a4f488704fd04e7f01

Linux f6ad0a481342223b2e7ae9f55b154e14f1391ada <d3641afe6ee76d852834a34ef0669eefced32752

Linux patch: 6.6.158

Linux 3.7

Linux f6ad0a481342223b2e7ae9f55b154e14f1391ada <d3a421c82412344022982d5b91ba23194a0a6f29

Linux f6ad0a481342223b2e7ae9f55b154e14f1391ada <740f595f8ad678cb4d79f13edd12851df2492bdd

Linux patch: 5.15.222

Linux patch: 7.2.8

Linux patch: 6.18.54

Linux patch: 7.3-rc4

Linux f6ad0a481342223b2e7ae9f55b154e14f1391ada <314966b490323bdcfd3162a1398b00e587e0ced4

Linux patch: 5.10.271

Linux f6ad0a481342223b2e7ae9f55b154e14f1391ada <23383e0578b58ba2dc0730cf9f7806bd66bf859a

Linux f6ad0a481342223b2e7ae9f55b154e14f1391ada <e2948c4232209e87c861a680f20f1e3cf8a57fec

Linux patch: 0

Linux f6ad0a481342223b2e7ae9f55b154e14f1391ada <a1ff367e0dc961d73707add508a95df5c3509bd1

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Oct 06, 2026 - 10:02 EUVD

CVE Published

Oct 06, 2026 - 08:44 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score

0.2%

Top 93% exploitable

Data Quality

3 sources

Confidence: Low

EUVD

CVE.org

EPSS MSRC

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

No CVSS yet + weak signal (CWE or non-zero EPSS)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.