CVE-2026-99034

Description

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-sprd: disable runtime PM on remove sdhci_sprd_probe() enables runtime PM, while sdhci_sprd_remove() does not perform the corresponding runtime PM cleanup. The probe failure path disables runtime PM before disabling the clocks, but the normal remove path directly disables clocks that are also managed by the runtime PM callbacks. If the device is runtime suspended, those clocks may already be disabled. Resume the device before removal, disable runtime PM and drop the temporary runtime PM reference before disabling the clocks. This issue was found by manual code inspection.

Is your site exposed to CVE-2026-99034?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0018

Probability of exploitation

0.07%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/03244b8713d044425db5dbee08037ecd79b684f9 https://git.kernel.org/stable/c/3a1caa886d41d9bcc9a402906336eda34a90d323 https://git.kernel.org/stable/c/605a59639abb9cb63cd7676460461fb0b34756b3 https://git.kernel.org/stable/c/dbad91a31c482063c0a87c90aa83c9001972c6ac https://git.kernel.org/stable/c/e1c6c10a6a70a69e29b04fcc1ebe4b9bcbc7a49a

Frequently Asked Questions

What is CVE-2026-99034? +

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-sprd: disable runtime PM on remove sdhci_sprd_probe() enables runtime PM, while sdhci_sprd_remove() does not perform the corresponding runtime PM cleanup. The probe failure path disables runtime PM before disabling the clocks, but the normal remove path directly disables clocks that are also managed by the runtime PM callbacks. If the device is runtime suspended, those clocks may already be disabled. Resume the device before removal, disable runtime PM and drop the temporary runtime PM reference before disabling the clocks. This issue was found by manual code inspection.

How do I check if I'm vulnerable to CVE-2026-99034? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.