{"id":"CVE-2026-97502","revision":"3eecdc1d9e3c4e958dbd60053b19a736","records":[{"revision":"3eecdc1d9e3c4e958dbd60053b19a736","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-97502","aliases":[],"title":"mmc: davinci: avoid NULL deref of host->data in IRQ handler","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: davinci: avoid NULL deref of host->data in IRQ handler\n\nmmc_davinci_irq() returns early only when both host->cmd and\nhost->data are NULL:\n\n  if (host->cmd == NULL && host->data == NULL) {\n          ...\n          return IRQ_NONE;\n  }\n\nSo we may legitimately reach the rest of the handler with\nhost->data == NULL (and therefore data == NULL). The DATDNE branch\nalready guards against this with an explicit \"if (data != NULL)\"\ncheck, but the subsequent TOUTRD (\"read data timeout\") and\nCRCWR/CRCRD (\"data CRC error\") branches dereference data\nunconditionally:\n\n  if (qstatus & MMCST0_TOUTRD) {\n          data->error = -ETIMEDOUT;        <-- NULL deref\n          ...\n          davinci_abort_data(host, data);\n  }\n\n  if (qstatus & (MMCST0_CRCWR | MMCST0_CRCRD)) {\n          data->error = -EILSEQ;           <-- NULL deref\n          ...\n  }\n\nIf either bit is set in qstatus while host->data is NULL, the kernel\nwill crash inside the IRQ handler. smatch flags this:\n\n  drivers/mmc/host/davinci_mmc.c:933 mmc_davinci_irq() error: we\n    previously assumed 'data' could be null (see line 914)\n\nGate both branches on a non-NULL data, matching the existing pattern\nused by the DATDNE branch.\n\nNo functional change for callers where data is non-NULL, which is\nthe only case in which these branches did meaningful work before\nthis change.","state":0,"publishedAt":"2026-09-24T16:04:49.056+00:00","modifiedAt":"2026-10-03T10:59:02.767+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/mmc/host/davinci_mmc.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"b4cff4549b7a8c5fc8b88e3493b6287555f0512c\",\n                            \"lessThan\": \"51738de7dd5f8e8b33dfc07ef85bc06d3bf41e96\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b4cff4549b7a8c5fc8b88e3493b6287555f0512c\",\n                            \"lessThan\": \"f216cf00e829895ff49bdf695c944915e59bd698\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b4cff4549b7a8c5fc8b88e3493b6287555f0512c\",\n                            \"lessThan\": \"a0cde8d70d64c1a75fbd57f01d9f2d7cccac8319\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b4cff4549b7a8c5fc8b88e3493b6287555f0512c\",\n                            \"lessThan\": \"3c5e3e5badbf0592332887d12db02458323682c3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b4cff4549b7a8c5fc8b88e3493b6287555f0512c\",\n                            \"lessThan\": \"a01cedf230dc0fcd55b994f5e548d3982ba4c732\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b4cff4549b7a8c5fc8b88e3493b6287555f0512c\",\n                            \"lessThan\": \"5b7e151fe9ea9311ba601849aaecdc4fc97fd577\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b4cff4549b7a8c5fc8b88e3493b6287555f0512c\",\n                            \"lessThan\": \"4f28846aaf8db9668e338b8987973f8935edff34\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/mmc/host/davinci_mmc.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2.6.33\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.6.33\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.271\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.222\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.189\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.111\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.53\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/51738de7dd5f8e8b33dfc07ef85bc06d3bf41e96","https://git.kernel.org/stable/c/f216cf00e829895ff49bdf695c944915e59bd698","https://git.kernel.org/stable/c/a0cde8d70d64c1a75fbd57f01d9f2d7cccac8319","https://git.kernel.org/stable/c/3c5e3e5badbf0592332887d12db02458323682c3","https://git.kernel.org/stable/c/a01cedf230dc0fcd55b994f5e548d3982ba4c732","https://git.kernel.org/stable/c/5b7e151fe9ea9311ba601849aaecdc4fc97fd577","https://git.kernel.org/stable/c/4f28846aaf8db9668e338b8987973f8935edff34"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-97502","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-97502","identifiers":["CVE-2026-97502"]},"retained":false,"historicalAffected":[]}],"coverage":[]}