CVE-2026-89440 - Vulnerability Details

- mmc: via-sdmmc: stop card-detect handling on probe failure

Description

In the Linux kernel, the following vulnerability has been resolved:

mmc: via-sdmmc: stop card-detect handling on probe failure

request_irq() registers the SD card-detect interrupt and the probe enables
it before mmc_add_host() runs. If mmc_add_host() fails, the error path only
unmaps the registers and returns: the interrupt stays registered, so the
handler keeps running against the host once it is freed. via_sdc_isr()
dereferences sdhost and its MMIO base and schedules carddet_work, which
via_sdc_card_detect() also runs against freed memory through its
container_of() dereference.

Add a probe-error path that disables and frees the interrupt and cancels
carddet_work before unmapping. carddet_work can re-enable the device
interrupt via via_reset_pcictrl(), which restores PCIINTCTRL, so mask it
again after cancelling the work.

This issue was found by an in-house static analysis tool and confirmed by
manual code review.

Published: 2026-09-11

Score: 5.8 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`e4e46fb61e3bb4628170810d3f2b996b709b90d9`	affected	< efe7f25dd27e35063477b4b0e7eed3675669fd99
`e4e46fb61e3bb4628170810d3f2b996b709b90d9`	affected	< 2550f89589caad7402d618d7dffc038582c94b6b
`e4e46fb61e3bb4628170810d3f2b996b709b90d9`	affected	< c2b8a624911999399cc14822fec3e35032b3cee4
`e4e46fb61e3bb4628170810d3f2b996b709b90d9`	affected	< 088eaa92fcebaa6b957ccf9635afdf39643a577d
`076bcd2c93e16b05c10564e299d6e5d26a766d00`	affected	—
`12b8e81b77c05c658efd9cde3585bbd65ae39b59`	affected	—
`95025a8dd0ec015872f6c16473fe04d6264e68ca`	affected	—
`f59ef2a47a228e51322ad76752a55a8917c56e38`	affected	—
`63400da6cd37a9793c19bb6aed7131b58b975a04`	affected	—
`0959cc1685eb19774300d43ef25e318b457b156b`	affected	—
`0ec94795114edc7e24ec71849dce42bfa61dafa3`	affected	—
`ba91b413983a9235792523c6b9f7ba2586c4d75d`	affected	—
`4.9.337`	affected	< 4.10
`4.14.303`	affected	< 4.15
`4.19.270`	affected	< 4.20
`5.4.229`	affected	< 5.5
`5.10.163`	affected	< 5.11
`5.15.86`	affected	< 5.16
`6.0.16`	affected	< 6.1
`6.1.2`	affected	< 6.2

Linux

affected

Version	Status	Constraints
`6.2`	affected	—
`0`	unaffected	< 6.2
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[e4e46fb61e3bb4628170810d3f2b996b709b90d9,efe7f25dd27e35063477b4b0e7eed3675669fd99)`	affected	code_commit	—
`[e4e46fb61e3bb4628170810d3f2b996b709b90d9,2550f89589caad7402d618d7dffc038582c94b6b)`	affected	code_commit	—
`[e4e46fb61e3bb4628170810d3f2b996b709b90d9,c2b8a624911999399cc14822fec3e35032b3cee4)`	affected	code_commit	—
`[e4e46fb61e3bb4628170810d3f2b996b709b90d9,088eaa92fcebaa6b957ccf9635afdf39643a577d)`	affected	code_commit	—
`076bcd2c93e16b05c10564e299d6e5d26a766d00`	affected	code_commit	—
`12b8e81b77c05c658efd9cde3585bbd65ae39b59`	affected	code_commit	—
`95025a8dd0ec015872f6c16473fe04d6264e68ca`	affected	code_commit	—
`f59ef2a47a228e51322ad76752a55a8917c56e38`	affected	code_commit	—
`63400da6cd37a9793c19bb6aed7131b58b975a04`	affected	code_commit	—
`0959cc1685eb19774300d43ef25e318b457b156b`	affected	code_commit	—
`0ec94795114edc7e24ec71849dce42bfa61dafa3`	affected	code_commit	—
`ba91b413983a9235792523c6b9f7ba2586c4d75d`	affected	code_commit	—
`[4.9.337,4.10)`	affected	semver	—
`[4.14.303,4.15)`	affected	semver	—
`[4.19.270,4.20)`	affected	semver	—
`[5.4.229,5.5)`	affected	semver	—
`[5.10.163,5.11)`	affected	semver	—
`[5.15.86,5.16)`	affected	semver	—
`[6.0.16,6.1)`	affected	semver	—
`[6.1.2,6.2)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.2`	affected	semver	—
`[0,6.2)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.002.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/088eaa92fcebaa6b957ccf9635afdf39643a577d
https://git.kernel.org/stable/c/2550f89589caad7402d618d7dffc038582c94b6b
https://git.kernel.org/stable/c/c2b8a624911999399cc14822fec3e35032b3cee4
https://git.kernel.org/stable/c/efe7f25dd27e35063477b4b0e7eed3675669fd99
https://nvd.nist.gov/vuln/detail/CVE-2026-89440
https://www.cve.org/CVERecord?id=CVE-2026-89440

History

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89440 https://www.cve.org/CVERecord?id=CVE-2026-89440
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.8, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: stop card-detect handling on probe failure request_irq() registers the SD card-detect interrupt and the probe enables it before mmc_add_host() runs. If mmc_add_host() fails, the error path only unmaps the registers and returns: the interrupt stays registered, so the handler keeps running against the host once it is freed. via_sdc_isr() dereferences sdhost and its MMIO base and schedules carddet_work, which via_sdc_card_detect() also runs against freed memory through its container_of() dereference. Add a probe-error path that disables and frees the interrupt and cancels carddet_work before unmapping. carddet_work can re-enable the device interrupt via via_reset_pcictrl(), which restores PCIINTCTRL, so mask it again after cancelling the work. This issue was found by an in-house static analysis tool and confirmed by manual code review.
Title		mmc: via-sdmmc: stop card-detect handling on probe failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/088eaa92fcebaa6b957ccf9635afdf39643a577d https://git.kernel.org/stable/c/2550f89589caad7402d618d7dffc038582c94b6b https://git.kernel.org/stable/c/c2b8a624911999399cc14822fec3e35032b3cee4 https://git.kernel.org/stable/c/efe7f25dd27e35063477b4b0e7eed3675669fd99

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:09.402Z

Updated: 2026-09-11T19:43:09.402Z

Reserved: 2026-09-11T19:38:34.703Z

Link: CVE-2026-89440

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:24.330

Modified: 2026-09-11T20:19:24.330

Link: CVE-2026-89440

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:43:09Z

Links: CVE-2026-89440 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-12T19:30:17Z

Weaknesses

CWE-825

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object