CVE-2026-80556

Received Received - Intake

Use-After-Free in Linux Kernel MMC atmel-mci Driver

Publication date: 2026-08-26

Last updated on: 2026-08-27

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition In atmci_probe, &host->bh_work is bound with atmci_work_func, and atmci_interrupt, atmci_timeout_timer and atmci_dma_complete can all queue this work on system_bh_wq. If we remove the module, atmci_remove makes cleanup and the memory allocated for host with devm_kzalloc() is released after the remove callback returns, while the work mentioned above may still be pending or running. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | atmci_interrupt | queue_work(system_bh_wq, | &host->bh_work) atmci_remove | atmci_cleanup_slot(...) | atmci_writel(host, ATMCI_IDR, ~0UL) | timer_delete_sync(&host->timer) | dma_release_channel(host->dma.chan) | free_irq(platform_get_irq(pdev, 0), host) | | atmci_work_func | // use host // devm resources released after | // remove returns, host is freed | | // use host (use-after-free) Fix it by canceling the work after all the sources that can schedule it (IRQ handler, timeout timer and DMA completion callback) have been stopped, and before proceeding with the remaining cleanup in atmci_remove.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-27

Generated

2026-09-16

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2026-80556

EUVD

EUVD-2026-66471

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	mmc	-

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's MMC (MultiMediaCard) driver for Atmel devices. It occurs in the atmel-mci driver where a race condition can lead to a freed memory being accessed. The issue happens when the module is removed while a work function is still pending or running, causing the system to attempt to use memory that has already been released.

Detection Guidance

This vulnerability is specific to the Linux kernel's MMC subsystem (atmel-mci driver) and requires kernel-level inspection. Check if your system uses the affected driver by running: lsmod | grep atmel_mci. If loaded, monitor for crashes or memory corruption during module removal or work queue execution.

Impact Analysis

This vulnerability could cause system crashes, data corruption, or potential privilege escalation if exploited. It may lead to instability in systems using the affected MMC driver, especially those with removable storage or SD card interfaces.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's MMC driver, caused by a race condition during module removal. It does not directly relate to data privacy or security controls required by GDPR or HIPAA. Compliance impact would depend on whether the affected system processes sensitive data, but the vulnerability itself is not a direct violation of these standards.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for CVE-2026-80556. If immediate update isn't possible, avoid unloading the atmel-mci module while the system is under I/O load to reduce risk of the race condition.

Hi! I’m here to help you understand CVE-2026-80556. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70