CVE-2026-89440: mmc: via-sdmmc: stop card-detect handling on probe failure
In the Linux kernel, the following vulnerability has been resolved:
mmc: via-sdmmc: stop card-detect handling on probe failure
requestirq() registers the SD card-detect interrupt and the probe enables it before mmcaddhost() runs. If mmcaddhost() fails, the error path only unmaps the registers and returns: the interrupt stays registered, so the handler keeps running against the host once it is freed. viasdcisr() dereferences sdhost and its MMIO base and schedules carddetwork, which viasdccarddetect() also runs against freed memory through its containerof() dereference.
Add a probe-error path that disables and frees the interrupt and cancels carddetwork before unmapping. carddetwork can re-enable the device interrupt via viaresetpcictrl(), which restores PCIINTCTRL, so mask it again after cancelling the work.
This issue was found by an in-house static analysis tool and confirmed by manual code review.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In via-sdmmc probe, if mmc_add_host() fails, take the probe-error path that disables and frees interrupt-related handling: mask the SD card-detect interrupt via_reset_pcictrl() (restores PCIINTCTRL, so ensure PCIINTCTRL masking is applied) before mmc_add_host() runs; then cancel carddet_work and ensure it cannot run after the registers/MMIO are unmapped (unmap only after cancelling/freeing carddet_work).
Linux kernel (mmc: via-sdmmc) card-detect handling on probe failure = stop card-detect handling when mmc_add_host() fails (disable interrupt handling and ensure carddet_work is cancelled/freed before unmapping)
Event History
Frequently Asked Questions
When can the use-after-free occur?
It can occur when the via-sdmmc driver's probe reaches request_irq() and enables SD card-detect handling, but mmc_add_host() subsequently fails. The registered interrupt handler or queued card-detect work can then access the freed host structure and its MMIO mapping.
What activity can trigger access to freed memory after the failed probe?
An SD card-detect interrupt can invoke via_sdc_isr(), which dereferences the freed host state and schedules card-detect work. That work can also dereference freed memory through its container_of() usage.
What should be done if the fix cannot be deployed immediately?
The provided data does not identify a configuration workaround. The affected condition is tied to a failed driver probe after card-detect interrupt registration, so systems using the via-sdmmc driver should prioritize applying a kernel version containing the referenced fix.