EUVD-2026-66471
GHSA-4ppc-mf9q-3j92
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Module removal requires root or CAP_SYS_MODULE (PR:H), and the race condition imposes non-trivial timing constraints (AC:H); UAF in kernel context enables full confidentiality, integrity, and availability compromise.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition
In atmci_probe, &host->bh_work is bound with atmci_work_func, and atmci_interrupt, atmci_timeout_timer and atmci_dma_complete can all queue this work on system_bh_wq.
If we remove the module, atmci_remove makes cleanup and the memory allocated for host with devm_kzalloc() is released after the remove callback returns, while the work mentioned above may still be pending or running. The sequence of operations that may lead to a UAF bug is as follows:
CPU0 CPU1
| atmci_interrupt | queue_work(system_bh_wq, | &host->bh_work) atmci_remove | atmci_cleanup_slot(...) | atmci_writel(host, ATMCI_IDR, ~0UL) | timer_delete_sync(&host->timer) | dma_release_channel(host->dma.chan) | free_irq(platform_get_irq(pdev, 0), host) |
| atmci_work_func | // use host // devm resources released after | // remove returns, host is freed |
| // use host (use-after-free) Fix it by canceling the work after all the sources that can schedule it (IRQ handler, timeout timer and DMA completion callback) have been stopped, and before proceeding with the remaining cleanup in atmci_remove.
AnalysisAI
Use-after-free race condition in the Linux kernel atmel-mci MMC/SD controller driver allows a local privileged user to corrupt freed kernel memory by racing module removal against queued bottom-half work items. Systems running Linux on Atmel AT91 or AVR32 SoC hardware with the atmel-mci driver loaded are exclusively affected; x86/x64 deployments are unaffected by design. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three concurrent conditions are required: (1) the target must run Linux on hardware with an Atmel MCI peripheral (AT91 or AVR32 SoC) - this driver is not present on x86/x64/generic ARM systems; (2) the attacker must hold root privileges or CAP_SYS_MODULE capability to execute rmmod and unload the driver; (3) an MMC/SD card must be active and generating interrupt or DMA traffic at the moment of module removal to ensure a work item is enqueued on system_bh_wq. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The reported CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects local exploitation, but two metric choices overstate exploitability: PR:L understates the required privilege level, as unloading kernel modules via rmmod requires CAP_SYS_MODULE or root in virtually all Linux configurations, making PR:H more accurate; and AC:L understates the timing constraint imposed by the race condition, which is not trivially reproducible on demand. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with root or CAP_SYS_MODULE on an Atmel AT91 embedded Linux system inserts an SD card to generate sustained MMC interrupt or DMA activity, queuing work on system_bh_wq, then issues rmmod atmel_mci at the precise moment a work item is pending. The work item dereferences the freed host structure after devm cleanup, allowing the attacker to corrupt kernel heap state and redirect execution flow. … |
| Remediation | Upgrade to a patched kernel release: 6.12.105 or later for the 6.12.x stable branch, 6.18.46 or later for 6.18.x, 7.1.10 or later for 7.1.x, or 7.2 or later for mainline. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Linux on Atmel AT91 or AVR32 SoC hardware by auditing device inventory and firmware deployments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today