In the Linux kernel, the following vulnerability has been resolved:

mmc: sdhci-sprd: disable runtime PM on remove

sdhci_sprd_probe() enables runtime PM, while sdhci_sprd_remove() does
not perform the corresponding runtime PM cleanup.

The probe failure path disables runtime PM before disabling the clocks,
but the normal remove path directly disables clocks that are also
managed by the runtime PM callbacks. If the device is runtime
suspended, those clocks may already be disabled.

Resume the device before removal, disable runtime PM and drop the
temporary runtime PM reference before disabling the clocks.

This issue was found by manual code inspection.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
fb8bd90f83c4dd86bc7fdae406152d63c5852f92 affected < 605a59639abb9cb63cd7676460461fb0b34756b3
fb8bd90f83c4dd86bc7fdae406152d63c5852f92 affected < 03244b8713d044425db5dbee08037ecd79b684f9
fb8bd90f83c4dd86bc7fdae406152d63c5852f92 affected < 3a1caa886d41d9bcc9a402906336eda34a90d323
fb8bd90f83c4dd86bc7fdae406152d63c5852f92 affected < dbad91a31c482063c0a87c90aa83c9001972c6ac
fb8bd90f83c4dd86bc7fdae406152d63c5852f92 affected < e1c6c10a6a70a69e29b04fcc1ebe4b9bcbc7a49a
Linux Linux affected
Version Status Constraints
4.20 affected —
0 unaffected < 4.20
6.6.160 unaffected ≤ 6.6.*
6.12.113 unaffected ≤ 6.12.*
6.18.57 unaffected ≤ 6.18.*
7.2.11 unaffected ≤ 7.2.*
7.3 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/03244b8713d044425db5dbee08037ecd79b684f9 cve-icon cve-icon
https://git.kernel.org/stable/c/3a1caa886d41d9bcc9a402906336eda34a90d323 cve-icon cve-icon
https://git.kernel.org/stable/c/605a59639abb9cb63cd7676460461fb0b34756b3 cve-icon cve-icon
https://git.kernel.org/stable/c/dbad91a31c482063c0a87c90aa83c9001972c6ac cve-icon cve-icon
https://git.kernel.org/stable/c/e1c6c10a6a70a69e29b04fcc1ebe4b9bcbc7a49a cve-icon cve-icon
History

Fri, 23 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-404

Fri, 23 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-sprd: disable runtime PM on remove sdhci_sprd_probe() enables runtime PM, while sdhci_sprd_remove() does not perform the corresponding runtime PM cleanup. The probe failure path disables runtime PM before disabling the clocks, but the normal remove path directly disables clocks that are also managed by the runtime PM callbacks. If the device is runtime suspended, those clocks may already be disabled. Resume the device before removal, disable runtime PM and drop the temporary runtime PM reference before disabling the clocks. This issue was found by manual code inspection.
Title mmc: sdhci-sprd: disable runtime PM on remove
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-23T12:21:41.941Z

Reserved: 2026-09-25T10:25:14.387Z

Link: CVE-2026-99034

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-23T13:17:26.580

Modified: 2026-10-23T13:17:26.580

Link: CVE-2026-99034

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T15:15:14Z

Weaknesses