CVE-2026-80556: mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition
In the Linux kernel, the following vulnerability has been resolved:
mmc: atmel-mci: Fix use-after-free in atmciremove due to race condition
In atmciprobe, &host->bhwork is bound with atmciworkfunc, and atmciinterrupt, atmcitimeouttimer and atmcidmacomplete can all queue this work on systembhwq.
If we remove the module, atmciremove makes cleanup and the memory allocated for host with devmkzalloc() is released after the remove callback returns, while the work mentioned above may still be pending or running. The sequence of operations that may lead to a UAF bug is as follows:
CPU0 CPU1
| atmciinterrupt | queuework(systembhwq, | &host->bhwork) atmciremove | atmcicleanupslot(...) | atmciwritel(host, ATMCIIDR, ~0UL) | timerdeletesync(&host->timer) | dmareleasechannel(host->dma.chan) | freeirq(platformgetirq(pdev, 0), host) | | atmciworkfunc | // use host // devm resources released after | // remove returns, host is freed | | // use host (use-after-free)
Fix it by canceling the work after all the sources that can schedule it (IRQ handler, timeout timer and DMA completion callback) have been stopped, and before proceeding with the remaining cleanup in atmciremove.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In atmci_remove, stop all sources that can schedule host->bh_work—the IRQ handler, timeout timer, and DMA completion callback—then cancel the work before proceeding with remaining cleanup, so atmci_work_func cannot access host after devm resources are released.
Event History
Frequently Asked Questions
When can the use-after-free be triggered?
It can occur during driver or module removal when bottom-half work remains pending or running after the host resources are freed. The work may have been queued by the interrupt handler, timeout timer, or DMA completion callback.
What conditions are needed for exploitation?
An attacker would need to cause or coincide with queued driver work while the Atmel MCI driver is being removed. The vulnerable race depends on concurrent work scheduling and teardown rather than a normal steady-state operation alone.
What can be done before an update is available?
Avoid removing the affected driver or module while it may be handling interrupts, timer activity, or DMA completion work. The fix stops these work sources and cancels the queued work before continuing cleanup.
Which kernel versions are affected?
The provided data does not identify affected or fixed kernel version numbers. It provides stable-kernel commit references for the resolved issue.