CVE-2026-89441

mmc: via-sdmmc: cancel card-detect work on remove

State: Published
Severity: 7.8 High
Published: Sep 11, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

mmc: via-sdmmc: cancel card-detect work on remove

Disabling the device interrupt and freeing the IRQ prevents new card-detect work from being queued, but carddet_work already queued by the handler can still run after via_sd_remove() returns. via_sdc_card_detect() recovers the host through container_of() and dereferences its MMIO base; once remove() returns the host can be freed, so that work would touch freed memory.

Cancel carddet_work after freeing the IRQ and before cancelling finish_bh_work, which the card-detect handler can also queue. carddet_work can re-enable the interrupt through via_reset_pcictrl(); mask it again afterwards.

This issue was found by an in-house static analysis tool and confirmed by manual code review.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f0bf7f61b8405224bc52fc9a3ccd167a68126e00 to before 28e8e9e1f3bdb75b611ea14c39775455528c4012Affected f0bf7f61b8405224bc52fc9a3ccd167a68126e00 to before a32603f9b4dd0a1c3ea5845eec7c95f5f8741b3dAffected f0bf7f61b8405224bc52fc9a3ccd167a68126e00 to before 3ee1b5c8618a26811840bf9f45cb3120dac1e273Affected f0bf7f61b8405224bc52fc9a3ccd167a68126e00 to before 55d71c70f11d9f92c7d2653774001e98cb509debAffected f0bf7f61b8405224bc52fc9a3ccd167a68126e00 to before 0a3c70191868fb007c03ff79693ad4e4b3fdcbb8Affected f0bf7f61b8405224bc52fc9a3ccd167a68126e00 to before f7ff3027ef004a331ef911a4886f12bc2e996037Affected f0bf7f61b8405224bc52fc9a3ccd167a68126e00 to before eaca730c6f5e3609df62a0469fb789235a93d276Affected f0bf7f61b8405224bc52fc9a3ccd167a68126e00 to before 57e5d877f898d5e5c9d672a77bb6bdd24f0d9bf5Affected
LinuxLinux	2.6.31Affected before 2.6.31Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.50 through 6.18.Not affected 7.2.4 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

f0bf7f61b8405224bc52fc9a3ccd167a68126e00 to before 28e8e9e1f3bdb75b611ea14c39775455528c4012Affected
f0bf7f61b8405224bc52fc9a3ccd167a68126e00 to before a32603f9b4dd0a1c3ea5845eec7c95f5f8741b3dAffected
f0bf7f61b8405224bc52fc9a3ccd167a68126e00 to before 3ee1b5c8618a26811840bf9f45cb3120dac1e273Affected
f0bf7f61b8405224bc52fc9a3ccd167a68126e00 to before 55d71c70f11d9f92c7d2653774001e98cb509debAffected
f0bf7f61b8405224bc52fc9a3ccd167a68126e00 to before 0a3c70191868fb007c03ff79693ad4e4b3fdcbb8Affected
f0bf7f61b8405224bc52fc9a3ccd167a68126e00 to before f7ff3027ef004a331ef911a4886f12bc2e996037Affected
f0bf7f61b8405224bc52fc9a3ccd167a68126e00 to before eaca730c6f5e3609df62a0469fb789235a93d276Affected
f0bf7f61b8405224bc52fc9a3ccd167a68126e00 to before 57e5d877f898d5e5c9d672a77bb6bdd24f0d9bf5Affected

LinuxLinux

2.6.31Affected
before 2.6.31Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.50 through 6.18.*Not affected
7.2.4 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.