CVE-2026-89441

A use-after-free exists in the Linux kernel's VIA SD/MMC host controller driver (drivers/mmc/host/via-sdmmc.c): card-detect work (carddet_work) already queued by the interrupt handler can still run after via_sd_remove() returns, at which point the host structure and its MMIO base may have been freed, so the callback dereferences freed memory. The flaw is triggered by device removal or driver unbind on VIA-chipset hardware while a card-detect interrupt is pending, which requires local access with low privileges. Successful exploitation can yield kernel memory corruption with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8). Only systems actually built on the affected VIA SD/MMC controller hardware are exposed by this code path; the flaw was found by static analysis and confirmed by code review, with no public PoC, no KEV listing, and no known exploitation.

What to do: Apply kernel security updates once your distro backports the fix, which cancels carddet_work after freeing the IRQ and before cancelling finish_bh_work, then re-masks the interrupt after via_reset_pcictrl(). Check whether VIA SD/MMC host controller hardware is present (e.g., via lspci) — systems without the device are not reachable through this code path. As a mitigation on affected hosts, restrict local privileged access and the ability to unbind the driver or unload modules.