CVE-2026-89440: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89440 Overview

CVE-2026-89440 is a use-after-free vulnerability in the Linux kernel's via-sdmmc MMC host driver. The flaw occurs in the driver's probe error path when mmc_add_host() fails. The probe registers the SD card-detect interrupt via request_irq() and enables it before mmc_add_host() runs. If that call fails, the existing error handler only unmaps registers and returns without unregistering the interrupt. The via_sdc_isr() handler continues to dereference the freed sdhost structure and its MMIO base, and it schedules carddet_work, which also accesses freed memory through a container_of() dereference.

Critical Impact
A local attacker with the ability to trigger the failing probe path can cause kernel memory corruption, resulting in denial of service or potential local privilege escalation on affected systems.

Affected Products

Linux kernel builds containing the via-sdmmc MMC host driver
Systems using VIA SD/MMC controllers exposed by the affected driver
Multiple stable kernel branches referenced in the kernel.org fix commits

Discovery Timeline

2026-09-11 - CVE-2026-89440 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89440

Vulnerability Analysis

The vulnerability resides in the probe sequence of the via-sdmmc driver. During initialization, the driver calls request_irq() to register the SD card-detect interrupt handler and enables interrupt delivery before mmc_add_host() completes. When mmc_add_host() returns an error, the original error path unmaps device registers and returns without freeing the IRQ or cancelling pending work.

After the freed path executes, the interrupt remains registered against the host structure. Any subsequent card-detect interrupt causes via_sdc_isr() to dereference the freed sdhost object and the unmapped MMIO base. The handler also schedules carddet_work, and via_sdc_card_detect() accesses freed memory through its container_of() dereference. Because carddet_work can re-enable the device interrupt through via_reset_pcictrl(), simply cancelling the work is not sufficient without masking the interrupt again.

Root Cause

The root cause is an incomplete cleanup sequence in a driver probe error path, resulting in a classic use-after-free condition on kernel memory. The IRQ registration lifetime exceeded the lifetime of the object the handler operates on.

Attack Vector

Exploitation requires local access with the ability to influence probe outcomes for the via-sdmmc driver, such as through device attachment, PCI hotplug, or triggering the failure condition in mmc_add_host(). Successful exploitation yields kernel memory corruption from an interrupt context.

No synthetic proof-of-concept is provided. Refer to the upstream fix commits, including Kernel Commit 088eaa92 and Kernel Commit efe7f25d, for the exact code changes.

Detection Methods for CVE-2026-89440

Indicators of Compromise

Kernel oops or panic messages referencing via_sdc_isr, via_sdc_card_detect, or carddet_work in dmesg or journalctl -k output.
KASAN use-after-free reports naming the via-sdmmc driver in kernels built with CONFIG_KASAN=y.
Unexpected system instability or crashes shortly after PCI hotplug or module load events involving VIA SD/MMC controllers.

Detection Strategies

Inventory running kernel versions across Linux endpoints and compare against the patched stable releases published on kernel.org.
Monitor for loading of the via-sdmmc kernel module on systems that do not require VIA SD/MMC hardware support.
Correlate kernel crash telemetry with recent hardware attach or module load events to identify probe-failure exploitation attempts.

Monitoring Recommendations

Forward kernel logs and crash dumps to a centralized logging or SIEM platform for retention and analysis.
Alert on repeated mmc_add_host failure messages followed by IRQ-related faults on the same host.
Track module load and unload events for storage host controller drivers on production Linux systems.

How to Mitigate CVE-2026-89440

Immediate Actions Required

Update affected Linux systems to a kernel release that includes the upstream fix commits listed in the NVD entry.
On systems that do not require VIA SD/MMC hardware, blacklist the via-sdmmc module to remove the vulnerable code path.
Restrict local access and hardware attachment on shared or multi-tenant hosts until patches are deployed.

Patch Information

The upstream fix adds a probe-error path that disables and frees the interrupt and cancels carddet_work before unmapping the device registers. It also re-masks the device interrupt after cancelling the work, because carddet_work can re-enable it via via_reset_pcictrl(). Fix commits include 088eaa92, 2550f895, 5bb5327b, 806409f1, c2b8a624, d0455967, dde5b9c9, and efe7f25d.

Workarounds

Unload the via-sdmmc module on systems that do not use VIA SD/MMC controllers.
Disable PCI hotplug for the affected controller class where operational requirements permit.
Enforce strict local access controls to reduce the population of users able to trigger the probe path.

bash

# Prevent the vulnerable driver from loading until the kernel is patched
echo "blacklist via-sdmmc" | sudo tee /etc/modprobe.d/blacklist-via-sdmmc.conf
sudo modprobe -r via-sdmmc 2>/dev/null || true
sudo update-initramfs -u