In the Linux kernel, the removal routine for devices using the via‑sdmmc driver fails to cancel outstanding card‑detect work before freeing the IRQ and releasing the host structure. As a result, the queued carddet_work may still run after via_sd_remove returns, dereferencing a freed MMIO base pointer. This use‑after‑free allows a local user to tamper with the device (for example, by rapidly inserting and removing an SD card) and potentially trigger arbitrary memory corruption that could lead to code execution or a system crash. The flaw is rooted in improper timing of work cancellation and memory deallocation.

The defect impacts any Linux kernel build that includes the via‑sdmmc card‑detect code without the applied fix. No specific kernel version range is provided, so all distributions that ship versions before the vulnerability was patched are potentially vulnerable. This applies to generic Linux kernels, including those used in embedded devices, servers, and desktop systems that rely on the MMC subsystem.

The CVSS score is 4.1, indicating a moderate severity. The EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited active exploitation. Attackers would need local or physical access to trigger the flaw; a dedicated SD card removal operation could trigger the corrupted work. While exploitation is not guaranteed, the combination of memory corruption and kernel context grants a potential for local privilege escalation or denial of service.