CVE-2026-89440

A flaw was found in the Linux kernel's mmc: via-sdmmc component. During the probe process, if the mmc_add_host() function fails, the SD card-detect interrupt handler continues to operate on memory that has already been released. This can lead to memory corruption, potentially allowing a local attacker to cause system instability or execute unauthorized code.

via-sdmmc can leave the SD card detect IRQ registered when mmc_add_host fails during probe. After the probe error path releases the host and unmaps MMIO, a later card detect interrupt or queued carddet_work can still dereference sdhost and its MMIO base, creating a use-after-free and stale MMIO access in kernel context. For the CVSS the PR:L is used for the paranoid score because a delegated device management context, reduced capability root, or service account with driver bind and device reset control may be enough in some deployments, although full administrative control is more typical. The issue is not network reachable and requires the affected VIA SD/MMC controller plus a probe failure window. Impact is at least local denial of service via kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.