Executive brief
The Linux kernel's VIA SD/MMC host controller driver contains a use-after-free vulnerability in the card-detect interrupt handler. When the device is removed, queued work items can execute after the driver frees its internal data structures, causing the kernel to crash or potentially allowing code execution on systems using affected hardware.
Technical details
The vulnerability is a use-after-free (CWE-416) in the via-sdmmc driver's removal path. When via_sd_remove() is called, the driver disables interrupts and calls free_irq(), but the carddet_work workqueue item queued by the interrupt handler can still execute after the function returns. The via_sdc_card_detect() handler dereferences the MMIO base through container_of(), accessing memory that has been freed. The fix cancels the carddet_work after freeing the IRQ but before final cleanup, and re-masks the interrupt since carddet_work may re-enable it through via_reset_pcictrl(). No local authentication or network access is required; a local attacker with device removal privileges can trigger the vulnerability, and the impact is kernel crash or potential privilege escalation.
Affected products
- Linux Linux kernel Affects multiple versions from at least 2.6.11 through 6.x; fixes available in upstream and stable branches
Timeline
- 2026-09-11: disclosed: Published in NVD
- 2026-07-27: patched: Upstream patch committed by Ulf Hansson
- 2026-09-07: patched: Backported to stable branches by Greg Kroah-Hartman