---
id: CVE-2026-89441
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mmc: via-sdmmc: cancel card-detect work on remove

  Disabling the device interrupt and freeing the IRQ prevents new card-detect
  work from being queued, but carddet_work …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mmc: via-sdmmc: cancel card-detect work on remove

  Disabling the device interrupt and freeing the IRQ prevents new card-detect
  work from being queued, but carddet_work …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-825
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f0bf7f61b8405224bc52fc9a3ccd167a68126e00 <
    0a3c70191868fb007c03ff79693ad4e4b3fdcbb8
  - >-
    Linux >= f0bf7f61b8405224bc52fc9a3ccd167a68126e00 <
    f7ff3027ef004a331ef911a4886f12bc2e996037
  - >-
    Linux >= f0bf7f61b8405224bc52fc9a3ccd167a68126e00 <
    eaca730c6f5e3609df62a0469fb789235a93d276
  - >-
    Linux >= f0bf7f61b8405224bc52fc9a3ccd167a68126e00 <
    57e5d877f898d5e5c9d672a77bb6bdd24f0d9bf5
  - Linux 2.6.31
published: '2026-09-11'
updated: '2026-10-03'
sourceUpdated: '2026-10-03T11:17:41.947'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89441'
references:
  - url: 'https://git.kernel.org/stable/c/0a3c70191868fb007c03ff79693ad4e4b3fdcbb8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/57e5d877f898d5e5c9d672a77bb6bdd24f0d9bf5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/eaca730c6f5e3609df62a0469fb789235a93d276'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f7ff3027ef004a331ef911a4886f12bc2e996037'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89441.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89441'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532479'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89441'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89441'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89441.mbox
  - url: 'https://git.kernel.org/stable/c/55d71c70f11d9f92c7d2653774001e98cb509deb'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00129
epssPercentile: 0.02527
scores:
  nvd: 7.8
  vendor: 5.5
  cna: 7.8
ingestedAt: '2026-09-14T15:23:07.475Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T19:22:13.294951Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mmc: via-sdmmc: cancel card-detect work on remove

Disabling the device interrupt and freeing the IRQ prevents new card-detect
work from being queued, but carddet_work already queued by the handler can
still run after via_sd_remove() returns. via_sdc_card_detect() recovers the
host through container_of() and dereferences its MMIO base; once remove()
returns the host can be freed, so that work would touch freed memory.

Cancel carddet_work after freeing the IRQ and before cancelling
finish_bh_work, which the card-detect handler can also queue. carddet_work
can re-enable the interrupt through via_reset_pcictrl(); mask it again
afterwards.

This issue was found by an in-house static analysis tool and confirmed by
manual code review.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89441.json)