A use‑after‑free flaw exists in the Linux kernel’s mmc/mmci driver. The ux500_busy_complete() routine can schedule ux500_busy_timeout_work during an R1b command, but the mmci_remove() function fails to cancel that work. When the controller is removed, the queued work later dereferences a device‑managed mmci_host that has already been freed, producing kernel memory corruption that could lead to arbitrary code execution with kernel privileges.

Any Linux kernel that contains the unpatched mmc/mmci driver is affected; this includes all distributions shipping the default MMC/SD host controller framework. No specific release numbers are listed, so all kernels built from the upstream source prior to the commits referenced should be considered at risk.

The flaw has a CVSS score of 7.0, an EPSS score of less than 1%, and is not listed in the CISA KEV catalog. The attack vector is local, requiring interaction with the MMC interface: an attacker who can cause the host controller to be removed while busy can trigger the use‑after‑free and potentially achieve kernel‑level code execution. The precise conditions for generating the busy‑timeout sequence are not fully detailed, so this scenario is inferred from the description.