The vub300 MMC driver in the Linux kernel contains a use‑after‑free race condition when the probe fails. If the probe thread arms an inactivity timer and mmc_add_host subsequently fails after the timer expires, a timer callback can queue work that references the driver while the probe error path frees the host. This leaves dangling references and can corrupt kernel memory; based on the description, it is inferred that a local attacker could execute arbitrary code with kernel privileges or crash the system.

All Linux kernel versions prior to the commit that fixes the vub300 use‑after‑free are affected. Any distribution shipping an unpatched kernel with the vub300 driver enabled is potentially vulnerable.

This flaw requires local system access, a timing window of about one second between the timer being armed and the mmc_add_host failure, and that mmc_add_host actually fails. Because these conditions are uncommon, the practical risk is considered low. It is inferred that a privileged local attacker could potentially exploit the flaw to crash the system or gain kernel privileges. The CVSS score of 5.5 indicates moderate severity, and the EPSS score is below 1%, indicating a low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, indicating that no active exploitation campaigns are known. The improper resource handling (CWE-825) contributes to the potential memory corruption or crash risk.