CVE-2026-80556 Overview
CVE-2026-80556 is a use-after-free vulnerability in the Linux kernel's atmel-mci MMC driver. The flaw exists in the atmci_remove function due to a race condition during module removal. The &host->bh_work structure, bound to atmci_work_func in atmci_probe, can be queued by atmci_interrupt, atmci_timeout_timer, and atmci_dma_complete on the system_bh_wq workqueue. When the module is unloaded, atmci_remove releases the host memory allocated via devm_kzalloc() while pending or running work items may still reference it, resulting in a use-after-free condition.
Critical Impact
A local attacker triggering the race window during driver removal can corrupt kernel memory, causing denial of service or potential local privilege escalation.
Affected Products
- Linux kernel with the atmel-mci MMC driver enabled
- Systems using Atmel MCI (Multimedia Card Interface) controllers
- Kernel branches receiving the referenced stable backports
Discovery Timeline
- 2026-08-26 - CVE-2026-80556 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-80556
Vulnerability Analysis
The defect is a classic use-after-free triggered by a race between driver teardown and asynchronous work execution. The atmel-mci driver binds &host->bh_work to atmci_work_func during atmci_probe. Three separate paths queue this work: the IRQ handler atmci_interrupt, the timeout handler atmci_timeout_timer, and the DMA completion callback atmci_dma_complete. Each path can enqueue work onto system_bh_wq at any time while the driver is loaded.
During module removal, atmci_remove performs cleanup via atmci_cleanup_slot, disables interrupts through atmci_writel(host, ATMCI_IDR, ~0UL), calls timer_delete_sync, releases the DMA channel, and frees the IRQ. However, work items already queued before these steps may still run afterward. Because host was allocated with devm_kzalloc(), the devres framework frees the allocation once atmci_remove returns, while atmci_work_func may still be executing and dereferencing the freed host pointer.
Root Cause
The root cause is missing synchronization between the workqueue lifecycle and the device-managed memory lifecycle. The driver never calls cancel_work_sync on &host->bh_work after shutting down its producers, so pending work may outlive the host allocation.
Attack Vector
Exploitation requires local access with sufficient privileges to trigger module unload or induce driver removal alongside I/O activity that keeps the work item queued. A carefully timed sequence of MMC operations concurrent with driver removal creates the race window. Refer to the upstream commits (22aecf6, 7599a73, b5060ff, c125ee3) for the exact code paths involved.
Detection Methods for CVE-2026-80556
Indicators of Compromise
- Kernel oops or panic traces referencing atmci_work_func, atmci_remove, or system_bh_wq in dmesg
- KASAN reports flagging use-after-free reads within the atmel-mci module
- Unexpected MMC subsystem crashes shortly after rmmod atmel-mci or device unbind events
Detection Strategies
- Enable CONFIG_KASAN and CONFIG_DEBUG_KMEMLEAK on test systems to surface use-after-free access patterns
- Monitor kernel ring buffer for slab-use-after-free reports involving devres-managed allocations
- Audit systems for unpatched atmel-mci driver versions against the fixed stable commits
Monitoring Recommendations
- Collect and centralize dmesg and journalctl -k output for offline analysis of kernel faults
- Alert on module load/unload events for atmel-mci correlated with active MMC I/O
- Track kernel versions across embedded and Atmel-based deployments to prioritize patching
How to Mitigate CVE-2026-80556
Immediate Actions Required
- Apply the upstream Linux kernel patches that add a cancel_work_sync call in atmci_remove after stopping all work producers
- Update to kernel builds that include commits 22aecf6, 7599a73, b5060ff, or c125ee3
- Restrict CAP_SYS_MODULE and module unload privileges to trusted administrators only
Patch Information
The fix cancels &host->bh_work after all sources that can schedule it (the IRQ handler, timeout timer, and DMA completion callback) have been stopped, and before proceeding with the remaining cleanup in atmci_remove. Patched commits are available in the stable kernel tree via the references listed above.
Workarounds
- Avoid unloading the atmel-mci module on production systems while MMC I/O is active
- Disable the atmel-mci driver in kernel configuration where the hardware is not required
- Blacklist module unload for atmel-mci on systems that cannot immediately apply the patch
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
