EUVD-2026-76347
GHSA-6v98-4pph-jq73
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition timing raises exploitation complexity to AC:H; all other metrics match CVSS input: local vector, low privilege, full impact triad.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
mmc: via-sdmmc: cancel card-detect work on remove
Disabling the device interrupt and freeing the IRQ prevents new card-detect work from being queued, but carddet_work already queued by the handler can still run after via_sd_remove() returns. via_sdc_card_detect() recovers the host through container_of() and dereferences its MMIO base; once remove() returns the host can be freed, so that work would touch freed memory.
Cancel carddet_work after freeing the IRQ and before cancelling finish_bh_work, which the card-detect handler can also queue. carddet_work can re-enable the interrupt through via_reset_pcictrl(); mask it again afterwards.
This issue was found by an in-house static analysis tool and confirmed by manual code review.
AnalysisAI
Use-after-free in the Linux kernel's via-sdmmc MMC host controller driver allows a local attacker to corrupt kernel memory during device removal. The driver's remove path (via_sd_remove()) frees the host structure while a previously-queued carddet_work work item can still dereference that freed memory via container_of() and MMIO base pointer access, creating a race-window that leads to memory corruption with C:H/I:H/A:H impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the target system must have VIA Technologies SD/MMC host controller hardware with the via-sdmmc driver loaded; (2) the attacker must have local, unprivileged OS access (PR:L per CVSS); (3) exploitation depends on winning a narrow race window between IRQ teardown and pending workqueue execution during device removal - this race is non-trivial to control reliably; (4) physical or software-triggered SD card hot-plug/removal events (or device unbind via sysfs) must be possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.1 scores this 7.8 (High) with AV:L/AC:L/PR:L - local, low-complexity, low-privilege. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Linux kernel to version 6.18.50 or 7.2.4 or later, which include the fix commits (f7ff3027ef00, eaca730c6f5e, 57e5d877f898) available at git.kernel.org/stable. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and catalog any systems running legacy embedded or budget hardware with VIA chipset MMC controllers (common in older network appliances, industrial equipment, and IoT devices); cross-reference against your kernel version inventory to determine exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today