Use-after-free in Linux kernel - CVE-2026-80556

Vulnerability details

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in the atmci_remove function in the atmel-mci driver when removing the module while queued or running bh_work is still pending. A local user can trigger a race condition during module removal to execute arbitrary code.

The issue arises because the interrupt handler, timeout timer, or DMA completion callback can schedule the work item before cleanup completes.

Affected software

How to mitigate CVE-2026-80556

External References

• https://git.kernel.org/stable/c/22aecf6c4721727a2f724ca0438bc7d4b609bf3f
• https://git.kernel.org/stable/c/7599a73ff66d195a908f5d88b427933a9fb1c02a
• https://git.kernel.org/stable/c/b5060ff2f5460795a3e9f7cdf5052aa42f96ff81
• https://git.kernel.org/stable/c/c125ee35a49a0518521b52b27631eef061b8719a

Related Security Bulletins

• Use-after-free in Linux kernel mmc host driver