During the removal of an MMC host in the Linux kernel’s mxcmmc driver, the driver fails to cancel an asynchronous watchdog timer and a data work handler that are scheduled by DMA and IRQ paths. The watchdog timer can fire after the host structure has already been freed, causing a dereference of a dangling pointer in mxcmci_watchdog(). The data work handler can similarly be invoked after release. The observed effect is a kernel crash (kernel panic) that can be triggered by forcing the removal of an MMC device. The CVE description does not state a confirmed code‑execution path, only that the flaw leads to a use‑after‑free and a crash.

All installations of the Linux kernel that include the mxcmmc driver are affected, as indicated by the generic CPE for the Linux kernel. No specific kernel release is listed, so any kernel containing the unpatched mxcmmc code is vulnerable. The vulnerability is tied to the core kernel code rather than a distribution or vendor‑specific patch set.

Because the flaw results in a kernel crash, it provides a high‑impact denial of service vector. The EPSS score indicates a low exploitation probability with < 1%, and the vulnerability is not listed in CISA’s KEV catalog, so the likelihood of exploitation in the wild is unknown. The CVSS score of 5.5 indicates moderate severity, but the use‑after‑free flaw and its impact on kernel stability imply a moderate surface. An attacker with the ability to trigger device removal could potentially cause a crash, and while the description does not confirm arbitrary code execution, a use‑after‑free that corrupts the state can, in theory, lead to escalation if exploited carefully.