CVE-2026-89441: Linux Kernel via-sdmmc Use-After-Free Vulnerability

CVE-2026-89441 Overview

CVE-2026-89441 is a use-after-free vulnerability in the Linux kernel mmc: via-sdmmc driver. The flaw exists in the removal path of the VIA SD/MMC host controller driver. When via_sd_remove() disables the device interrupt and frees the IRQ, it prevents new carddet_work items from being queued. However, work already queued by the interrupt handler can still execute after removal completes. The via_sdc_card_detect() handler uses container_of() to recover the host structure and dereferences its memory-mapped I/O base. Once remove() returns, the host memory can be freed, causing the queued work to touch freed memory.

Critical Impact
A local attacker with the ability to trigger device removal can cause kernel memory corruption, leading to denial of service or potential local privilege escalation.

Affected Products

Linux kernel with the via-sdmmc MMC host controller driver enabled
Distributions shipping vulnerable versions of the VIA SD/MMC driver
Systems using VIA SD/MMC controller hardware

Discovery Timeline

2026-09-11 - CVE-2026-89441 published to the National Vulnerability Database
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89441

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] in the via-sdmmc driver removal path. The driver registers a card-detect work handler, via_sdc_card_detect(), that runs asynchronously through the kernel workqueue. During removal, via_sd_remove() disables the device interrupt and frees the IRQ line. This ordering blocks new work from being scheduled but leaves already-queued work items in flight.

Any carddet_work instance that was queued before IRQ teardown can execute after via_sd_remove() returns. The handler recovers the enclosing host structure through container_of() and dereferences the MMIO base pointer. Because the MMC host structure is freed on driver detach, the running work item accesses freed kernel memory. This creates a race between driver teardown and the workqueue scheduler.

Root Cause

The root cause is missing synchronization between IRQ teardown and pending workqueue items. The driver assumed that disabling the interrupt was sufficient to prevent card-detect work execution. It did not call cancel_work_sync() on carddet_work before releasing the host structure. Additionally, carddet_work itself can re-enable the interrupt through via_reset_pcictrl(), requiring the interrupt to be masked again after cancellation to prevent further queuing of finish_bh_work.

Attack Vector

Exploitation requires local access with the ability to trigger driver unbind or device removal. An attacker with sufficient privileges to unbind the driver through sysfs, or to trigger PCI hot-remove events, can race the workqueue against the removal path. Successful exploitation leads to kernel memory corruption. The attack complexity is low because the race window exists during any driver removal operation. No user interaction is required beyond initiating the removal.

See the Linux kernel security advisory commit for technical details of the fix.

Detection Methods for CVE-2026-89441

Indicators of Compromise

Kernel oops or panic messages referencing via_sdc_card_detect or carddet_work in dmesg output
KASAN (Kernel Address Sanitizer) reports flagging use-after-free in the via-sdmmc module
Unexpected system crashes correlated with SD/MMC device unbind or hot-remove events

Detection Strategies

Enable KASAN in test kernels to surface use-after-free conditions in the via-sdmmc driver during removal testing
Monitor kernel ring buffer logs for stack traces involving container_of and MMC host dereferences after driver removal
Audit installed kernel versions against upstream stable releases containing the patched commits

Monitoring Recommendations

Collect and centralize kernel logs to detect crash patterns tied to MMC subsystem activity
Track driver bind and unbind events through auditd or equivalent kernel event monitoring
Correlate device removal operations with subsequent kernel instability across the fleet

How to Mitigate CVE-2026-89441

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in commits 57e5d87, eaca730, and f7ff302 as soon as vendor updates are available
Restrict local privileged access that would allow driver unbind or PCI hot-remove operations on affected systems
Prioritize patching on systems with VIA SD/MMC controllers exposed to multi-user or lower-privileged workloads

Patch Information

The fix cancels carddet_work after freeing the IRQ and before cancelling finish_bh_work. Because carddet_work can re-enable the interrupt through via_reset_pcictrl(), the patch also masks the interrupt again after cancellation. Patched commits are available in the mainline and stable kernel trees: Kernel Git Commit 57e5d87, Kernel Git Commit eaca730, and Kernel Git Commit f7ff302.

Workarounds

Blacklist the via-sdmmc kernel module on systems that do not require VIA SD/MMC support
Restrict access to sysfs paths that permit driver unbind operations on production systems
Avoid physical or virtual hot-removal of VIA SD/MMC devices on unpatched kernels

bash

# Blacklist the vulnerable module until patches are applied
echo "blacklist via-sdmmc" | sudo tee /etc/modprobe.d/blacklist-via-sdmmc.conf
sudo update-initramfs -u

# Verify the module is not loaded after reboot
lsmod | grep via_sdmmc