SB2026082779 - Use-after-free in Linux kernel mmc host driver

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-80556)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in the atmci_remove function in the atmel-mci driver when removing the module while queued or running bh_work is still pending. A local user can trigger a race condition during module removal to execute arbitrary code.

The issue arises because the interrupt handler, timeout timer, or DMA completion callback can schedule the work item before cleanup completes.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/22aecf6c4721727a2f724ca0438bc7d4b609bf3f
• https://git.kernel.org/stable/c/7599a73ff66d195a908f5d88b427933a9fb1c02a
• https://git.kernel.org/stable/c/b5060ff2f5460795a3e9f7cdf5052aa42f96ff81
• https://git.kernel.org/stable/c/c125ee35a49a0518521b52b27631eef061b8719a