CVE-2026-80556 - Vulnerability Details

- mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition

Description

In the Linux kernel, the following vulnerability has been resolved:

mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition

In atmci_probe, &host->bh_work is bound with atmci_work_func, and
atmci_interrupt, atmci_timeout_timer and atmci_dma_complete can all
queue this work on system_bh_wq.

If we remove the module, atmci_remove makes cleanup and the memory
allocated for host with devm_kzalloc() is released after the remove
callback returns, while the work mentioned above may still be pending
or running. The sequence of operations that may lead to a UAF bug is
as follows:

CPU0 CPU1

| atmci_interrupt
| queue_work(system_bh_wq,
| &host->bh_work)
atmci_remove |
atmci_cleanup_slot(...) |
atmci_writel(host, ATMCI_IDR, ~0UL) |
timer_delete_sync(&host->timer) |
dma_release_channel(host->dma.chan) |
free_irq(platform_get_irq(pdev, 0), host) |
| atmci_work_func
| // use host
// devm resources released after |
// remove returns, host is freed |
| // use host (use-after-free)

Fix it by canceling the work after all the sources that can schedule
it (IRQ handler, timeout timer and DMA completion callback) have been
stopped, and before proceeding with the remaining cleanup in
atmci_remove.

Published: 2026-08-26

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel the atmel‑mci driver contains a race condition between unloading the module and pending background work. When the module is removed, the host structure is freed while work queued by interrupt, timer, or DMA callbacks may still execute, accessing freed memory. This results in a use‑after‑free that can corrupt memory or crash the kernel.

Affected Systems

All Linux kernel builds that include the atmel‑mci driver without the applied fix. The affected product is the Linux kernel; any system compiling or loading the atmel‑mci module is at risk.

Risk and Exploitability

The vulnerability carries a CVSS score of 7.8, indicating moderate to high severity, while the EPSS score of less than 1% signals a low probability of exploitation. It is not listed in the CISA KEV catalog. Exploitation would occur if the driver is unloaded while an interrupt, timer or DMA completion is still pending or queued, potentially causing the kernel to crash or memory corruption.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`7d2be0749a59096a334c94dc48f43294193cb8ed`	affected	< 22aecf6c4721727a2f724ca0438bc7d4b609bf3f
`7d2be0749a59096a334c94dc48f43294193cb8ed`	affected	< b5060ff2f5460795a3e9f7cdf5052aa42f96ff81
`7d2be0749a59096a334c94dc48f43294193cb8ed`	affected	< 7599a73ff66d195a908f5d88b427933a9fb1c02a
`7d2be0749a59096a334c94dc48f43294193cb8ed`	affected	< c125ee35a49a0518521b52b27631eef061b8719a

Linux

affected

Version	Status	Constraints
`2.6.27`	affected	—
`0`	unaffected	< 2.6.27
`6.12.105`	unaffected	≤ 6.12.*
`6.18.46`	unaffected	≤ 6.18.*
`7.1.10`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[7d2be0749a59096a334c94dc48f43294193cb8ed,22aecf6c4721727a2f724ca0438bc7d4b609bf3f)`	affected	code_commit	—
`[7d2be0749a59096a334c94dc48f43294193cb8ed,b5060ff2f5460795a3e9f7cdf5052aa42f96ff81)`	affected	code_commit	—
`[7d2be0749a59096a334c94dc48f43294193cb8ed,7599a73ff66d195a908f5d88b427933a9fb1c02a)`	affected	code_commit	—
`[7d2be0749a59096a334c94dc48f43294193cb8ed,c125ee35a49a0518521b52b27631eef061b8719a)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.27`	affected	semver	—
`[0,2.6.27)`	unaffected	generic	—
`[6.12.105,6.13.0)`	unaffected	semver	—
`[6.18.46,6.19.0)`	unaffected	semver	—
`[7.1.10,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the vendor patch that contains the commit "Fix use‑after‑free in atmci_remove" or upgrade the kernel to a version that includes the fix
If an update cannot be applied immediately, unload or disable the atmel‑mci module with modprobe -r atmel-mci or configure the kernel to not load it at boot
Monitor kernel logs for MMC driver activity and verify that no use‑after‑free errors or abnormal crashes occur after patching or disabling the module

Generated by OpenCVE AI on August 28, 2026 at 17:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00125.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/22aecf6c4721727a2f724ca0438bc7d4b609bf3f
https://git.kernel.org/stable/c/7599a73ff66d195a908f5d88b427933a9fb1c02a
https://git.kernel.org/stable/c/b5060ff2f5460795a3e9f7cdf5052aa42f96ff81
https://git.kernel.org/stable/c/c125ee35a49a0518521b52b27631eef061b8719a
https://lore.kernel.org/linux-cve-announce/2026082609-CVE-2026-80556-04cc@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-80556
https://www.cve.org/CVERecord?id=CVE-2026-80556

History

Fri, 28 Aug 2026 09:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Thu, 27 Aug 2026 18:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026082609-CVE-2026-80556-04cc@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-80556 https://www.cve.org/CVERecord?id=CVE-2026-80556
Metrics	threat_severity `None`	threat_severity `Moderate`

Thu, 27 Aug 2026 09:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Thu, 27 Aug 2026 08:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Thu, 27 Aug 2026 06:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Wed, 26 Aug 2026 16:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Wed, 26 Aug 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition In atmci_probe, &host->bh_work is bound with atmci_work_func, and atmci_interrupt, atmci_timeout_timer and atmci_dma_complete can all queue this work on system_bh_wq. If we remove the module, atmci_remove makes cleanup and the memory allocated for host with devm_kzalloc() is released after the remove callback returns, while the work mentioned above may still be pending or running. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 \| atmci_interrupt \| queue_work(system_bh_wq, \| &host->bh_work) atmci_remove \| atmci_cleanup_slot(...) \| atmci_writel(host, ATMCI_IDR, ~0UL) \| timer_delete_sync(&host->timer) \| dma_release_channel(host->dma.chan) \| free_irq(platform_get_irq(pdev, 0), host) \| \| atmci_work_func \| // use host // devm resources released after \| // remove returns, host is freed \| \| // use host (use-after-free) Fix it by canceling the work after all the sources that can schedule it (IRQ handler, timeout timer and DMA completion callback) have been stopped, and before proceeding with the remaining cleanup in atmci_remove.
Title		mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/22aecf6c4721727a2f724ca0438bc7d4b609bf3f https://git.kernel.org/stable/c/7599a73ff66d195a908f5d88b427933a9fb1c02a https://git.kernel.org/stable/c/b5060ff2f5460795a3e9f7cdf5052aa42f96ff81 https://git.kernel.org/stable/c/c125ee35a49a0518521b52b27631eef061b8719a

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-26T14:37:23.573Z

Updated: 2026-08-27T05:01:44.585Z

Reserved: 2026-08-26T14:34:25.767Z

Link: CVE-2026-80556

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-26T15:17:10.253

Modified: 2026-08-27T06:17:39.387

Link: CVE-2026-80556

Redhat

Severity : Moderate

Publid Date: 2026-08-26T00:00:00Z

Links: CVE-2026-80556 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-28T17:45:04Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object