CVE-2026-89441

A flaw was found in the Linux kernel, specifically within the mmc: via-sdmmc driver responsible for managing SD and MultiMediaCard (MMC) devices. This vulnerability occurs during device removal, where a timing issue allows a process to attempt to access memory that has already been released. This unauthorized memory access can lead to system instability or cause the system to crash, resulting in a denial of service.

A moderate-severity use-after-free flaw was found in the Linux kernel VIA SD/MMC host controller driver (mmc: via-sdmmc), which affects Red Hat offerings that ship a Linux kernel containing this driver code. During device removal, disabling the device interrupt and freeing the IRQ prevents new card-detect work from being queued, but card-detect work already queued by the handler (carddet_work) can still run after via_sd_remove() returns. via_sdc_card_detect() recovers the host structure through container_of() and dereferences its MMIO base, so once remove() returns and the host can be freed, that work touches freed memory. A local attacker with low privileges able to trigger removal of the VIA SD/MMC PCI device could exploit this race to crash the kernel, causing a denial of service; confidentiality and integrity are not affected. Red Hat rates this flaw Moderate (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because it requires local access on systems with the affected hardware and impacts availability only. This differs from the upstream severity of Important (CVSS 7.8), which also scores high confidentiality and integrity impacts: the technical evidence shows the consequence is limited to touching freed kernel memory, which can crash the system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.