Linux Kernel CVE-2026-80556

Three concurrent conditions are required: (1) the target must run Linux on hardware with an Atmel MCI peripheral (AT91 or AVR32 SoC) - this driver is not present on x86/x64/generic ARM systems; (2) the attacker must hold root privileges or CAP_SYS_MODULE capability to execute rmmod and unload the driver; (3) an MMC/SD card must be active and generating interrupt or DMA traffic at the moment of module removal to ensure a work item is enqueued on system_bh_wq. Exploitation is further constrained by the race condition timing window - the work item must be queued before IRQ teardown and execute after devm releases the host allocation, which is not reliably reproducible without specific timing mechanisms. Default configurations are not directly exploitable by unprivileged remote attackers.

The reported CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects local exploitation, but two metric choices overstate exploitability: PR:L understates the required privilege level, as unloading kernel modules via rmmod requires CAP_SYS_MODULE or root in virtually all Linux configurations, making PR:H more accurate; and AC:L understates the timing constraint imposed by the race condition, which is not trivially reproducible on demand. Real-world exploitation impact remains high - a successful UAF in kernel context can achieve full kernel code execution - but the effective exploitation difficulty is meaningfully higher than the base score suggests. EPSS data is absent from available intelligence, and the vulnerability is not listed in CISA KEV, meaning no confirmed in-the-wild exploitation has been reported. No public proof-of-concept code is identified. The hardware-specific driver scope (Atmel AT91/AVR32 SoCs) substantially limits the affected population; this is a routine patch-cycle priority for embedded Linux operators using this hardware, not a broad enterprise emergency. SSVC signals: exploitation status = none known; automatable = no (race condition, hardware-specific); technical impact = total.

A local attacker with root or CAP_SYS_MODULE on an Atmel AT91 embedded Linux system inserts an SD card to generate sustained MMC interrupt or DMA activity, queuing work on system_bh_wq, then issues rmmod atmel_mci at the precise moment a work item is pending. The work item dereferences the freed host structure after devm cleanup, allowing the attacker to corrupt kernel heap state and redirect execution flow. No public proof-of-concept exists, but the pattern is consistent with well-documented Linux kernel UAF exploitation techniques.