CVE-2026-89440

The Linux kernel's VIA SD/MMC host controller driver (via-sdmmc) leaves the SD card-detect interrupt registered and enabled when mmc_add_host() fails during probe, because the original error path only unmapped the registers. The interrupt handler via_sdc_isr() then dereferences the freed host structure and its unmapped MMIO base, and schedules carddet_work, which via_sdc_card_detect() also runs against freed memory via its container_of() dereference. A local attacker with low privileges (CVSS 3.1: 7.8, AV:L/AC:L/PR:L/UI:N) could potentially leverage this use-after-free for kernel memory corruption, resulting in privilege escalation, information disclosure, or a system crash. Only systems with the VIA SD/MMC driver enabled (CONFIG_MMC_VIA_SDMMC) on compatible VIA chipsets are affected, and the bug additionally requires a rare probe failure to reach the vulnerable error path. No public proof-of-concept is known and the issue is not in the CISA KEV catalog; it was found by in-house static analysis and confirmed by manual code review.

What to do: Update to a kernel release containing the fix, which adds a proper probe-error path that disables and frees the card-detect interrupt, cancels carddet_work, and re-masks PCIINTCTRL before unmapping. On VIA SD/MMC hardware, check whether via_sdmmc is built in or loaded (e.g., lsmod or kernel config) and disable CONFIG_MMC_VIA_SDMMC if the SD host is unused. As defense in depth, restrict local unprivileged account access on systems that do require the driver.