EUVD-2026-76346
GHSA-g7ff-3gj4-4wp3
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Probe-failure trigger plus heap coordination needed for reliable UAF exploitation raises complexity to AC:H beyond the vendor's AC:L assignment.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
mmc: via-sdmmc: stop card-detect handling on probe failure
request_irq() registers the SD card-detect interrupt and the probe enables it before mmc_add_host() runs. If mmc_add_host() fails, the error path only unmaps the registers and returns: the interrupt stays registered, so the handler keeps running against the host once it is freed. via_sdc_isr() dereferences sdhost and its MMIO base and schedules carddet_work, which via_sdc_card_detect() also runs against freed memory through its container_of() dereference.
Add a probe-error path that disables and frees the interrupt and cancels carddet_work before unmapping. carddet_work can re-enable the device interrupt via via_reset_pcictrl(), which restores PCIINTCTRL, so mask it again after cancelling the work.
This issue was found by an in-house static analysis tool and confirmed by manual code review.
AnalysisAI
Use-after-free memory corruption in the Linux kernel's VIA SDMMC host controller driver (mmc/via-sdmmc) can cause kernel instability and potentially enable local privilege escalation on systems equipped with VIA SD card controllers. During driver probe failure, the card-detect interrupt and pending work item (carddet_work) are not cleaned up, leaving the interrupt handler and work queue running against already-freed memory; via_sdc_isr() dereferences the freed sdhost structure while via_sdc_card_detect() performs a container_of() dereference against freed memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the target system must physically contain a VIA Technologies SDMMC host controller with the via-sdmmc kernel module loaded; (2) mmc_add_host() must fail during driver probe - this may occur due to hardware configuration issues, resource exhaustion, or deliberate triggering if local code execution is already available; (3) following probe failure, a card-detect event (physical card insertion or removal, or a spurious interrupt) must fire the interrupt handler against the freed sdhost memory. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is substantially lower than the CVSS 7.8 base score implies in most production environments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a patched kernel release: Linux 6.12.109, 6.18.50, or 7.2.4 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify systems with VIA SD card controllers in your Linux infrastructure and assess patch compatibility with your supported kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today