CVE-2026-89440: mmc: via-sdmmc: stop card-detect handling on probe failure

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-11 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: stop card-detect handling on probe failure request_irq() registers the SD card-detect interrupt and the probe enables it before mmc_add_host() runs. If mmc_add_host() fails, the error path only unmaps the registers and returns: the interrupt stays registered, so the handler keeps running against the host once it is freed. via_sdc_isr() dereferences sdhost and its MMIO base and schedules carddet_work, which via_sdc_card_detect() also runs against freed memory through its container_of() dereference. Add a probe-error path that disables and frees the interrupt and cancels carddet_work before unmapping. carddet_work can re-enable the device interrupt via via_reset_pcictrl(), which restores PCIINTCTRL, so mask it again after cancelling the work. This issue was found by an in-house static analysis tool and confirmed by manual code review.

Affected products

Linux kernel: from 5.10.163 before 5.10.270; from 5.15.86 before 5.15.221; from 6.1.2 before 6.1.188; from 4.9.337 before 4.10; from 4.14.303 before 4.15; from 4.19.270 before 4.20 — fixed in 4.10, 4.15, 4.20, 5.10.270, 5.15.221, 5.5

How to fix

Upgrade to a fixed version: Linux kernel 4.10, 4.15, 4.20, 5.10.270. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-89440 or the next vulnerability affects your stack