{"id":"AZL-103793","summary":"CVE-2026-97502 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: davinci: avoid NULL deref of host-\u003edata in IRQ handler\n\nmmc_davinci_irq() returns early only when both host-\u003ecmd and\nhost-\u003edata are NULL:\n\n  if (host-\u003ecmd == NULL && host-\u003edata == NULL) {\n          ...\n          return IRQ_NONE;\n  }\n\nSo we may legitimately reach the rest of the handler with\nhost-\u003edata == NULL (and therefore data == NULL). The DATDNE branch\nalready guards against this with an explicit \"if (data != NULL)\"\ncheck, but the subsequent TOUTRD (\"read data timeout\") and\nCRCWR/CRCRD (\"data CRC error\") branches dereference data\nunconditionally:\n\n  if (qstatus & MMCST0_TOUTRD) {\n          data-\u003eerror = -ETIMEDOUT;        \u003c-- NULL deref\n          ...\n          davinci_abort_data(host, data);\n  }\n\n  if (qstatus & (MMCST0_CRCWR | MMCST0_CRCRD)) {\n          data-\u003eerror = -EILSEQ;           \u003c-- NULL deref\n          ...\n  }\n\nIf either bit is set in qstatus while host-\u003edata is NULL, the kernel\nwill crash inside the IRQ handler. smatch flags this:\n\n  drivers/mmc/host/davinci_mmc.c:933 mmc_davinci_irq() error: we\n    previously assumed 'data' could be null (see line 914)\n\nGate both branches on a non-NULL data, matching the existing pattern\nused by the DATDNE branch.\n\nNo functional change for callers where data is non-NULL, which is\nthe only case in which these branches did meaningful work before\nthis change.","modified":"2026-09-25T14:15:47.469105056Z","published":"2026-09-24T17:17:27Z","upstream":["CVE-2026-97502"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97502"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-103793.json"}}],"schema_version":"1.9.0"}