CVE-2026-89441

Received Received - Intake

Use-After-Free in Linux Kernel MMC via-sdmmc Driver

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: cancel card-detect work on remove Disabling the device interrupt and freeing the IRQ prevents new card-detect work from being queued, but carddet_work already queued by the handler can still run after via_sd_remove() returns. via_sdc_card_detect() recovers the host through container_of() and dereferences its MMIO base; once remove() returns the host can be freed, so that work would touch freed memory. Cancel carddet_work after freeing the IRQ and before cancelling finish_bh_work, which the card-detect handler can also queue. carddet_work can re-enable the interrupt through via_reset_pcictrl(); mask it again afterwards. This issue was found by an in-house static analysis tool and confirmed by manual code review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89441

EUVD

EUVD-2026-76347

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's mmc (MultiMediaCard) subsystem, specifically in the via-sdmmc driver. When the device is removed, an already queued card-detect work item can still run after the driver's remove function completes. This work item tries to access memory that has been freed, leading to potential crashes or arbitrary code execution.

Detection Guidance

This vulnerability is specific to the Linux kernel's mmc subsystem, particularly the via-sdmmc driver. Detection requires checking the kernel version and the presence of the affected driver. Use commands like 'uname -a' to check the kernel version and 'lsmod | grep via_sdmmc' to see if the vulnerable module is loaded.

Impact Analysis

If exploited, this vulnerability could cause system instability, crashes, or allow an attacker to execute arbitrary code with kernel privileges. It primarily affects systems using the via-sdmmc driver for SD/MMC card interfaces.

Mitigation Strategies

Update the Linux kernel to a version that includes the fix for this vulnerability. If the via-sdmmc driver is not in use, unload it with 'rmmod via_sdmmc'. Monitor kernel security advisories for patches and apply them promptly.

Hi! I’m here to help you understand CVE-2026-89441. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70