CVE-2026-89440 - Vulnerability Details

- mmc: via-sdmmc: stop card-detect handling on probe failure

Description

In the Linux kernel, the following vulnerability has been resolved:

mmc: via-sdmmc: stop card-detect handling on probe failure

request_irq() registers the SD card-detect interrupt and the probe enables
it before mmc_add_host() runs. If mmc_add_host() fails, the error path only
unmaps the registers and returns: the interrupt stays registered, so the
handler keeps running against the host once it is freed. via_sdc_isr()
dereferences sdhost and its MMIO base and schedules carddet_work, which
via_sdc_card_detect() also runs against freed memory through its
container_of() dereference.

Add a probe-error path that disables and frees the interrupt and cancels
carddet_work before unmapping. carddet_work can re-enable the device
interrupt via via_reset_pcictrl(), which restores PCIINTCTRL, so mask it
again after cancelling the work.

This issue was found by an in-house static analysis tool and confirmed by
manual code review.

Published: 2026-09-11

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability arises in the Linux kernel’s MMC via‑sdmmc driver when the probe routine fails. In that scenario the interrupt that handles SD card detection remains registered and work is scheduled against freed memory, triggering a use‑after‑free that can cause a kernel crash, representing a denial‑of‑service risk.

Affected Systems

All systems running a Linux kernel that includes the MMC via‑sdmmc subsystem are potentially affected. The exact version ranges are not disclosed in the current data, so any kernel that has not yet been updated with the patch that adds the failed‑probe cleanup code may be vulnerable.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity, and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog. Because the flaw manifests only after a probe failure, exploitation would require an attacker to induce to the SD card interface. No public exploit has been reported, but the kernel‑service attacks.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`63400da6cd37a9793c19bb6aed7131b58b975a04`	affected	< 5bb5327b92aae17e91c7228953c350a6ee3c94e8
`0959cc1685eb19774300d43ef25e318b457b156b`	affected	< d045596706d1b25d38af4a79980b017639fea9d1
`ba91b413983a9235792523c6b9f7ba2586c4d75d`	affected	< 806409f12fdb14c9e4c56a64494c9b75f356cd49
`e4e46fb61e3bb4628170810d3f2b996b709b90d9`	affected	< dde5b9c91e9fc64e54a2f186d3ae95868b4dbb02
`e4e46fb61e3bb4628170810d3f2b996b709b90d9`	affected	< efe7f25dd27e35063477b4b0e7eed3675669fd99
`e4e46fb61e3bb4628170810d3f2b996b709b90d9`	affected	< 2550f89589caad7402d618d7dffc038582c94b6b
`e4e46fb61e3bb4628170810d3f2b996b709b90d9`	affected	< c2b8a624911999399cc14822fec3e35032b3cee4
`e4e46fb61e3bb4628170810d3f2b996b709b90d9`	affected	< 088eaa92fcebaa6b957ccf9635afdf39643a577d
`076bcd2c93e16b05c10564e299d6e5d26a766d00`	affected	—
`12b8e81b77c05c658efd9cde3585bbd65ae39b59`	affected	—
`95025a8dd0ec015872f6c16473fe04d6264e68ca`	affected	—
`f59ef2a47a228e51322ad76752a55a8917c56e38`	affected	—
`0ec94795114edc7e24ec71849dce42bfa61dafa3`	affected	—
`5.10.163`	affected	< 5.10.270
`5.15.86`	affected	< 5.15.221
`6.1.2`	affected	< 6.1.188
`4.9.337`	affected	< 4.10
`4.14.303`	affected	< 4.15
`4.19.270`	affected	< 4.20
`5.4.229`	affected	< 5.5
`6.0.16`	affected	< 6.1

Linux

affected

Version	Status	Constraints
`6.2`	affected	—
`0`	unaffected	< 6.2
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[e4e46fb61e3bb4628170810d3f2b996b709b90d9,efe7f25dd27e35063477b4b0e7eed3675669fd99)`	affected	code_commit	—
`[e4e46fb61e3bb4628170810d3f2b996b709b90d9,2550f89589caad7402d618d7dffc038582c94b6b)`	affected	code_commit	—
`[e4e46fb61e3bb4628170810d3f2b996b709b90d9,c2b8a624911999399cc14822fec3e35032b3cee4)`	affected	code_commit	—
`[e4e46fb61e3bb4628170810d3f2b996b709b90d9,088eaa92fcebaa6b957ccf9635afdf39643a577d)`	affected	code_commit	—
`076bcd2c93e16b05c10564e299d6e5d26a766d00`	affected	code_commit	—
`12b8e81b77c05c658efd9cde3585bbd65ae39b59`	affected	code_commit	—
`95025a8dd0ec015872f6c16473fe04d6264e68ca`	affected	code_commit	—
`f59ef2a47a228e51322ad76752a55a8917c56e38`	affected	code_commit	—
`63400da6cd37a9793c19bb6aed7131b58b975a04`	affected	code_commit	—
`0959cc1685eb19774300d43ef25e318b457b156b`	affected	code_commit	—
`0ec94795114edc7e24ec71849dce42bfa61dafa3`	affected	code_commit	—
`ba91b413983a9235792523c6b9f7ba2586c4d75d`	affected	code_commit	—
`[4.9.337,4.10)`	affected	semver	—
`[4.14.303,4.15)`	affected	semver	—
`[4.19.270,4.20)`	affected	semver	—
`[5.4.229,5.5)`	affected	semver	—
`[5.10.163,5.11)`	affected	semver	—
`[5.15.86,5.16)`	affected	semver	—
`[6.0.16,6.1)`	affected	semver	—
`[6.1.2,6.2)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.2`	affected	semver	—
`[0,6.2)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to the latest release that contains the fix for the CWE-825 use‑after‑free flaw in the via‑sdmmc driver, which deregisters the interrupt and cancels pending work on probe failure.
If immediate kernel upgrade is not feasible, add 'blacklist sdmmc' to /etc/modprobe.d/blacklist.conf to prevent the vulnerable module from loading and thereby eliminate the CWE-825 condition.
Alternatively, temporarily disable the SD-card-detect interrupt in the device tree or via kernel command line parameters to avoid the use‑after‑free behavior until a patch is applied.

Generated by OpenCVE AI on September 21, 2026 at 01:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00176.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/088eaa92fcebaa6b957ccf9635afdf39643a577d
https://git.kernel.org/stable/c/2550f89589caad7402d618d7dffc038582c94b6b
https://git.kernel.org/stable/c/5bb5327b92aae17e91c7228953c350a6ee3c94e8
https://git.kernel.org/stable/c/806409f12fdb14c9e4c56a64494c9b75f356cd49
https://git.kernel.org/stable/c/c2b8a624911999399cc14822fec3e35032b3cee4
https://git.kernel.org/stable/c/d045596706d1b25d38af4a79980b017639fea9d1
https://git.kernel.org/stable/c/dde5b9c91e9fc64e54a2f186d3ae95868b4dbb02
https://git.kernel.org/stable/c/efe7f25dd27e35063477b4b0e7eed3675669fd99
https://nvd.nist.gov/vuln/detail/CVE-2026-89440
https://www.cve.org/CVERecord?id=CVE-2026-89440

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/5bb5327b92aae17e91c7228953c350a6ee3c94e8 https://git.kernel.org/stable/c/806409f12fdb14c9e4c56a64494c9b75f356cd49 https://git.kernel.org/stable/c/d045596706d1b25d38af4a79980b017639fea9d1 https://git.kernel.org/stable/c/dde5b9c91e9fc64e54a2f186d3ae95868b4dbb02

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.8, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89440 https://www.cve.org/CVERecord?id=CVE-2026-89440
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.8, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: stop card-detect handling on probe failure request_irq() registers the SD card-detect interrupt and the probe enables it before mmc_add_host() runs. If mmc_add_host() fails, the error path only unmaps the registers and returns: the interrupt stays registered, so the handler keeps running against the host once it is freed. via_sdc_isr() dereferences sdhost and its MMIO base and schedules carddet_work, which via_sdc_card_detect() also runs against freed memory through its container_of() dereference. Add a probe-error path that disables and frees the interrupt and cancels carddet_work before unmapping. carddet_work can re-enable the device interrupt via via_reset_pcictrl(), which restores PCIINTCTRL, so mask it again after cancelling the work. This issue was found by an in-house static analysis tool and confirmed by manual code review.
Title		mmc: via-sdmmc: stop card-detect handling on probe failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/088eaa92fcebaa6b957ccf9635afdf39643a577d https://git.kernel.org/stable/c/2550f89589caad7402d618d7dffc038582c94b6b https://git.kernel.org/stable/c/c2b8a624911999399cc14822fec3e35032b3cee4 https://git.kernel.org/stable/c/efe7f25dd27e35063477b4b0e7eed3675669fd99

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:09.402Z

Updated: 2026-09-14T11:59:51.359Z

Reserved: 2026-09-11T19:38:34.703Z

Link: CVE-2026-89440

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:24.330

Modified: 2026-09-14T13:19:01.230

Link: CVE-2026-89440

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:43:09Z

Links: CVE-2026-89440 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-21T01:45:07Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object