CVE-2026-72073

A flaw was found in the Linux kernel's vub300 driver, which manages MultiMediaCard (MMC) controllers. A race condition can occur during the driver's probe failure path. If the mmc_add_host() function fails after an inactivity timer has been armed, a use-after-free vulnerability can arise. This could potentially lead to system instability or a denial of service.

This vulnerability is rated as Moderate because triggering the flaw requires attaching or emulating a specialized VUB300 USB hardware adapter and inducing an uncommon probe failure delay. In typical Red Hat Enterprise Linux environments, the driver is not actively utilized unless specific USB-to-MMC bridge devices are attached to the host. Because exploitation necessitates physical access or the ability to attach virtual USB peripherals and only results in a system crash, overall impact is confined to a local denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.