{"id":"CVE-2026-89440","title":"mmc: via-sdmmc: stop card-detect handling on probe failure","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: via-sdmmc: stop card-detect handling on probe failure\n\nrequest_irq() registers the SD card-detect interrupt and the probe enables\nit before mmc_add_host() runs. If…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-825"],"vendor":"Linux","product":"Linux","affected":["Linux >= 63400da6cd37a9793c19bb6aed7131b58b975a04 < 5bb5327b92aae17e91c7228953c350a6ee3c94e8","Linux >= 0959cc1685eb19774300d43ef25e318b457b156b < d045596706d1b25d38af4a79980b017639fea9d1","Linux >= ba91b413983a9235792523c6b9f7ba2586c4d75d < 806409f12fdb14c9e4c56a64494c9b75f356cd49","Linux >= e4e46fb61e3bb4628170810d3f2b996b709b90d9 < dde5b9c91e9fc64e54a2f186d3ae95868b4dbb02","Linux >= e4e46fb61e3bb4628170810d3f2b996b709b90d9 < efe7f25dd27e35063477b4b0e7eed3675669fd99","Linux >= e4e46fb61e3bb4628170810d3f2b996b709b90d9 < 2550f89589caad7402d618d7dffc038582c94b6b","Linux >= e4e46fb61e3bb4628170810d3f2b996b709b90d9 < c2b8a624911999399cc14822fec3e35032b3cee4","Linux >= e4e46fb61e3bb4628170810d3f2b996b709b90d9 < 088eaa92fcebaa6b957ccf9635afdf39643a577d","Linux 076bcd2c93e16b05c10564e299d6e5d26a766d00","Linux 12b8e81b77c05c658efd9cde3585bbd65ae39b59","Linux 95025a8dd0ec015872f6c16473fe04d6264e68ca","Linux f59ef2a47a228e51322ad76752a55a8917c56e38","Linux 0ec94795114edc7e24ec71849dce42bfa61dafa3","Linux >= 5.10.163 < 5.10.270","Linux >= 5.15.86 < 5.15.221","Linux >= 6.1.2 < 6.1.188","Linux >= 4.9.337 < 4.10","Linux >= 4.14.303 < 4.15","Linux >= 4.19.270 < 4.20","Linux >= 5.4.229 < 5.5","Linux >= 6.0.16 < 6.1","Linux 6.2"],"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:46:49.770Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89440","references":[{"url":"https://git.kernel.org/stable/c/5bb5327b92aae17e91c7228953c350a6ee3c94e8"},{"url":"https://git.kernel.org/stable/c/d045596706d1b25d38af4a79980b017639fea9d1"},{"url":"https://git.kernel.org/stable/c/806409f12fdb14c9e4c56a64494c9b75f356cd49"},{"url":"https://git.kernel.org/stable/c/dde5b9c91e9fc64e54a2f186d3ae95868b4dbb02"},{"url":"https://git.kernel.org/stable/c/efe7f25dd27e35063477b4b0e7eed3675669fd99"},{"url":"https://git.kernel.org/stable/c/2550f89589caad7402d618d7dffc038582c94b6b"},{"url":"https://git.kernel.org/stable/c/c2b8a624911999399cc14822fec3e35032b3cee4"},{"url":"https://git.kernel.org/stable/c/088eaa92fcebaa6b957ccf9635afdf39643a577d"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89440.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89440"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532121"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89440"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89440"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89440.mbox"}],"tags":["cve.org","csaf","vex","red-hat"],"epss":0.00169,"epssPercentile":0.06186,"scores":{"cna":7.8,"vendor":7},"ingestedAt":"2026-09-14T15:23:07.454Z","slug":"CVE-2026-89440","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmmc: via-sdmmc: stop card-detect handling on probe failure\n\nrequest_irq() registers the SD card-detect interrupt and the probe enables\nit before mmc_add_host() runs. If mmc_add_host() fails, the error path only\nunmaps the registers and returns: the interrupt stays registered, so the\nhandler keeps running against the host once it is freed. via_sdc_isr()\ndereferences sdhost and its MMIO base and schedules carddet_work, which\nvia_sdc_card_detect() also runs against freed memory through its\ncontainer_of() dereference.\n\nAdd a probe-error path that disables and frees the interrupt and cancels\ncarddet_work before unmapping. carddet_work can re-enable the device\ninterrupt via via_reset_pcictrl(), which restores PCIINTCTRL, so mask it\nagain after cancelling the work.\n\nThis issue was found by an in-house static analysis tool and confirmed by\nmanual code review.\n\n## Affected\n\n- `Linux >= 63400da6cd37a9793c19bb6aed7131b58b975a04 < 5bb5327b92aae17e91c7228953c350a6ee3c94e8`\n- `Linux >= 0959cc1685eb19774300d43ef25e318b457b156b < d045596706d1b25d38af4a79980b017639fea9d1`\n- `Linux >= ba91b413983a9235792523c6b9f7ba2586c4d75d < 806409f12fdb14c9e4c56a64494c9b75f356cd49`\n- `Linux >= e4e46fb61e3bb4628170810d3f2b996b709b90d9 < dde5b9c91e9fc64e54a2f186d3ae95868b4dbb02`\n- `Linux >= e4e46fb61e3bb4628170810d3f2b996b709b90d9 < efe7f25dd27e35063477b4b0e7eed3675669fd99`\n- `Linux >= e4e46fb61e3bb4628170810d3f2b996b709b90d9 < 2550f89589caad7402d618d7dffc038582c94b6b`\n- `Linux >= e4e46fb61e3bb4628170810d3f2b996b709b90d9 < c2b8a624911999399cc14822fec3e35032b3cee4`\n- `Linux >= e4e46fb61e3bb4628170810d3f2b996b709b90d9 < 088eaa92fcebaa6b957ccf9635afdf39643a577d`\n- `Linux 076bcd2c93e16b05c10564e299d6e5d26a766d00`\n- `Linux 12b8e81b77c05c658efd9cde3585bbd65ae39b59`\n- `Linux 95025a8dd0ec015872f6c16473fe04d6264e68ca`\n- `Linux f59ef2a47a228e51322ad76752a55a8917c56e38`\n- `Linux 0ec94795114edc7e24ec71849dce42bfa61dafa3`\n- `Linux >= 5.10.163 < 5.10.270`\n- `Linux >= 5.15.86 < 5.15.221`\n- `Linux >= 6.1.2 < 6.1.188`\n- `Linux >= 4.9.337 < 4.10`\n- `Linux >= 4.14.303 < 4.15`\n- `Linux >= 4.19.270 < 4.20`\n- `Linux >= 5.4.229 < 5.5`\n- `Linux >= 6.0.16 < 6.1`\n- `Linux 6.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89440.json)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":224766,"id":"CVE-2026-89440","ts":1792401530840,"field":"cvss","old":"7","new":"7.8"},{"seq":204113,"id":"CVE-2026-89440","ts":1789490231634,"field":"cvss","old":"7.8","new":"7"},{"seq":183556,"id":"CVE-2026-89440","ts":1789356675871,"field":"cvss","old":"7.8","new":"5.8"},{"seq":183555,"id":"CVE-2026-89440","ts":1789356675871,"field":"severity","old":"high","new":"medium"},{"seq":153220,"id":"CVE-2026-89440","ts":1789285349604,"field":"cvss","old":null,"new":"7.8"},{"seq":153219,"id":"CVE-2026-89440","ts":1789285349604,"field":"severity","old":"none","new":"high"},{"seq":147736,"id":"CVE-2026-89440","ts":1789270212091,"field":"cvss","old":null,"new":"5.8"},{"seq":147735,"id":"CVE-2026-89440","ts":1789270212091,"field":"severity","old":"none","new":"medium"},{"seq":109484,"id":"CVE-2026-89440","ts":1789183732092,"field":"cvss","old":null,"new":"5.8"},{"seq":109483,"id":"CVE-2026-89440","ts":1789183732092,"field":"severity","old":"none","new":"medium"}]}