CVE-2026-89441
Description
In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: cancel card-detect work on remove Disabling the device interrupt and freeing the IRQ prevents new card-detect work from being queued, but carddet_work already queued by the handler can still run after via_sd_remove() returns. via_sdc_card_detect() recovers the host through container_of() and dereferences its MMIO base; once remove() returns the host can be freed, so that work would touch freed memory. Cancel carddet_work after freeing the IRQ and before cancelling finish_bh_work, which the card-detect handler can also queue. carddet_work can re-enable the interrupt through via_reset_pcictrl(); mask it again afterwards. This issue was found by an in-house static analysis tool and confirmed by manual code review.
How to fix
- Linux Linux28e8e9e1f3bdb75b611ea14c39775455528c4012, a32603f9b4dd0a1c3ea5845eec7c95f5f8741b3d, 3ee1b5c8618a26811840bf9f45cb3120dac1e273, 55d71c70f11d9f92c7d2653774001e98cb509deb, 0a3c70191868fb007c03ff79693ad4e4b3fdcbb8, f7ff3027ef004a331ef911a4886f12bc2e996037, eaca730c6f5e3609df62a0469fb789235a93d276, 57e5d877f898d5e5c9d672a77bb6bdd24f0d9bf5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | f0bf7f61b8405224bc52fc9a3ccd167a68126e00 ≤ v < 28e8e9e1f3bdb75b611ea14c39775455528c4012, f0bf7f61b8405224bc52fc9a3ccd167a68126e00 ≤ v < a32603f9b4dd0a1c3ea5845eec7c95f5f8741b3d, f0bf7f61b8405224bc52fc9a3ccd167a68126e00 ≤ v < 3ee1b5c8618a26811840bf9f45cb3120dac1e273, f0bf7f61b8405224bc52fc9a3ccd167a68126e00 ≤ v < 55d71c70f11d9f92c7d2653774001e98cb509deb, f0bf7f61b8405224bc52fc9a3ccd167a68126e00 ≤ v < 0a3c70191868fb007c03ff79693ad4e4b3fdcbb8, f0bf7f61b8405224bc52fc9a3ccd167a68126e00 ≤ v < f7ff3027ef004a331ef911a4886f12bc2e996037, f0bf7f61b8405224bc52fc9a3ccd167a68126e00 ≤ v < eaca730c6f5e3609df62a0469fb789235a93d276, f0bf7f61b8405224bc52fc9a3ccd167a68126e00 ≤ v < 57e5d877f898d5e5c9d672a77bb6bdd24f0d9bf5, 2.6.31 | 28e8e9e1f3bdb75b611ea14c39775455528c4012, a32603f9b4dd0a1c3ea5845eec7c95f5f8741b3d, 3ee1b5c8618a26811840bf9f45cb3120dac1e273, 55d71c70f11d9f92c7d2653774001e98cb509deb, 0a3c70191868fb007c03ff79693ad4e4b3fdcbb8, f7ff3027ef004a331ef911a4886f12bc2e996037, eaca730c6f5e3609df62a0469fb789235a93d276, 57e5d877f898d5e5c9d672a77bb6bdd24f0d9bf5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.