CVE-2026-89440 - Vulnerability Details

- mmc: via-sdmmc: stop card-detect handling on probe failure

Description

In the Linux kernel, the following vulnerability has been resolved:

mmc: via-sdmmc: stop card-detect handling on probe failure

request_irq() registers the SD card-detect interrupt and the probe enables
it before mmc_add_host() runs. If mmc_add_host() fails, the error path only
unmaps the registers and returns: the interrupt stays registered, so the
handler keeps running against the host once it is freed. via_sdc_isr()
dereferences sdhost and its MMIO base and schedules carddet_work, which
via_sdc_card_detect() also runs against freed memory through its
container_of() dereference.

Add a probe-error path that disables and frees the interrupt and cancels
carddet_work before unmapping. carddet_work can re-enable the device
interrupt via via_reset_pcictrl(), which restores PCIINTCTRL, so mask it
again after cancelling the work.

This issue was found by an in-house static analysis tool and confirmed by
manual code review.

Published: 2026-09-11

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability arises in the Linux kernel’s MMC via‑sdmmc driver when the probe routine fails. In that scenario the interrupt that handles SD card detection remains registered and work is scheduled against freed memory, triggering a use‑after‑free that can cause a kernel crash, representing a denial‑of‑service risk.

Affected Systems

All systems running a Linux kernel that includes the MMC via‑sdmmc subsystem are potentially affected. The exact version ranges are not disclosed in the current data, so any kernel that has not yet been updated with the patch that adds the failed‑probe cleanup code may be vulnerable.

Risk and Exploitability

The CVSS score of 5.8 indicates moderate severity, and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog. Because the flaw manifests only after a probe failure, exploitation would require an attacker to induce such a failure—likely via local hardware access to the SD card interface. No public exploit has been reported, but the kernel crash could be used to perform denial‑of‑service attacks.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`e4e46fb61e3bb4628170810d3f2b996b709b90d9`	affected	< efe7f25dd27e35063477b4b0e7eed3675669fd99
`e4e46fb61e3bb4628170810d3f2b996b709b90d9`	affected	< 2550f89589caad7402d618d7dffc038582c94b6b
`e4e46fb61e3bb4628170810d3f2b996b709b90d9`	affected	< c2b8a624911999399cc14822fec3e35032b3cee4
`e4e46fb61e3bb4628170810d3f2b996b709b90d9`	affected	< 088eaa92fcebaa6b957ccf9635afdf39643a577d
`076bcd2c93e16b05c10564e299d6e5d26a766d00`	affected	—
`12b8e81b77c05c658efd9cde3585bbd65ae39b59`	affected	—
`95025a8dd0ec015872f6c16473fe04d6264e68ca`	affected	—
`f59ef2a47a228e51322ad76752a55a8917c56e38`	affected	—
`63400da6cd37a9793c19bb6aed7131b58b975a04`	affected	—
`0959cc1685eb19774300d43ef25e318b457b156b`	affected	—
`0ec94795114edc7e24ec71849dce42bfa61dafa3`	affected	—
`ba91b413983a9235792523c6b9f7ba2586c4d75d`	affected	—
`4.9.337`	affected	< 4.10
`4.14.303`	affected	< 4.15
`4.19.270`	affected	< 4.20
`5.4.229`	affected	< 5.5
`5.10.163`	affected	< 5.11
`5.15.86`	affected	< 5.16
`6.0.16`	affected	< 6.1
`6.1.2`	affected	< 6.2

Linux

affected

Version	Status	Constraints
`6.2`	affected	—
`0`	unaffected	< 6.2
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[e4e46fb61e3bb4628170810d3f2b996b709b90d9,efe7f25dd27e35063477b4b0e7eed3675669fd99)`	affected	code_commit	—
`[e4e46fb61e3bb4628170810d3f2b996b709b90d9,2550f89589caad7402d618d7dffc038582c94b6b)`	affected	code_commit	—
`[e4e46fb61e3bb4628170810d3f2b996b709b90d9,c2b8a624911999399cc14822fec3e35032b3cee4)`	affected	code_commit	—
`[e4e46fb61e3bb4628170810d3f2b996b709b90d9,088eaa92fcebaa6b957ccf9635afdf39643a577d)`	affected	code_commit	—
`076bcd2c93e16b05c10564e299d6e5d26a766d00`	affected	code_commit	—
`12b8e81b77c05c658efd9cde3585bbd65ae39b59`	affected	code_commit	—
`95025a8dd0ec015872f6c16473fe04d6264e68ca`	affected	code_commit	—
`f59ef2a47a228e51322ad76752a55a8917c56e38`	affected	code_commit	—
`63400da6cd37a9793c19bb6aed7131b58b975a04`	affected	code_commit	—
`0959cc1685eb19774300d43ef25e318b457b156b`	affected	code_commit	—
`0ec94795114edc7e24ec71849dce42bfa61dafa3`	affected	code_commit	—
`ba91b413983a9235792523c6b9f7ba2586c4d75d`	affected	code_commit	—
`[4.9.337,4.10)`	affected	semver	—
`[4.14.303,4.15)`	affected	semver	—
`[4.19.270,4.20)`	affected	semver	—
`[5.4.229,5.5)`	affected	semver	—
`[5.10.163,5.11)`	affected	semver	—
`[5.15.86,5.16)`	affected	semver	—
`[6.0.16,6.1)`	affected	semver	—
`[6.1.2,6.2)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.2`	affected	semver	—
`[0,6.2)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that includes the patch which deregisters the SD‑card interrupt and cancels pending work on probe failure.
If a kernel upgrade is not immediately available, prevent the MMC via‑sdmmc module (e.g., add `blacklist sdmmc` to `/etc/modprobe.d/blacklist.conf`).
As a temporary measure on systems that must continue to use the MMC subsystem, disable the SD‑card detect interrupt in the device tree or use kernel command line parameters to turn off the relevant interrupt class.

Generated by OpenCVE AI on September 13, 2026 at 07:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.002.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/088eaa92fcebaa6b957ccf9635afdf39643a577d
https://git.kernel.org/stable/c/2550f89589caad7402d618d7dffc038582c94b6b
https://git.kernel.org/stable/c/c2b8a624911999399cc14822fec3e35032b3cee4
https://git.kernel.org/stable/c/efe7f25dd27e35063477b4b0e7eed3675669fd99
https://nvd.nist.gov/vuln/detail/CVE-2026-89440
https://www.cve.org/CVERecord?id=CVE-2026-89440

History

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.8, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89440 https://www.cve.org/CVERecord?id=CVE-2026-89440
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.8, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: stop card-detect handling on probe failure request_irq() registers the SD card-detect interrupt and the probe enables it before mmc_add_host() runs. If mmc_add_host() fails, the error path only unmaps the registers and returns: the interrupt stays registered, so the handler keeps running against the host once it is freed. via_sdc_isr() dereferences sdhost and its MMIO base and schedules carddet_work, which via_sdc_card_detect() also runs against freed memory through its container_of() dereference. Add a probe-error path that disables and frees the interrupt and cancels carddet_work before unmapping. carddet_work can re-enable the device interrupt via via_reset_pcictrl(), which restores PCIINTCTRL, so mask it again after cancelling the work. This issue was found by an in-house static analysis tool and confirmed by manual code review.
Title		mmc: via-sdmmc: stop card-detect handling on probe failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/088eaa92fcebaa6b957ccf9635afdf39643a577d https://git.kernel.org/stable/c/2550f89589caad7402d618d7dffc038582c94b6b https://git.kernel.org/stable/c/c2b8a624911999399cc14822fec3e35032b3cee4 https://git.kernel.org/stable/c/efe7f25dd27e35063477b4b0e7eed3675669fd99

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:09.402Z

Updated: 2026-09-13T06:29:22.178Z

Reserved: 2026-09-11T19:38:34.703Z

Link: CVE-2026-89440

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:24.330

Modified: 2026-09-13T07:17:08.490

Link: CVE-2026-89440

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:43:09Z

Links: CVE-2026-89440 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-13T07:30:17Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object