Executive brief
The Linux kernel's Atmel MCI (MultiMedia Card Interface) driver contains a use-after-free vulnerability in its module removal code. When the driver is unloaded, queued work items may still execute after kernel memory is freed, potentially allowing local attackers to crash the system or execute code with kernel privileges.
Technical details
This is a use-after-free vulnerability (CWE-416) in the atmel-mci device driver's module removal path. The atmci_remove function stops the interrupt handler, timer, and DMA channel, then frees devm-allocated memory, but does not cancel pending work items scheduled on system_bh_wq. A race condition can occur where atmci_work_func continues to execute and dereference the freed &host structure after atmci_remove completes. The vulnerability requires the driver to be actively processing interrupts, timeouts, or DMA completions at the moment of module removal. The fix involves calling cancel_work_sync() after disabling interrupt sources but before memory deallocation. The patch is available in the Linux kernel development tree.
Affected products
- Linux Linux kernel unfixed versions in development
Timeline
- 2026-08-26: disclosed
- 2026-08-26: patched: fix merged in kernel development