# CVE-2026-89441

## Summary

- **CVE ID:** CVE-2026-89441
- **Severity:** HIGH
- **CVSS Score:** 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- **CWE:** N/A
- **Published:** Sep 11, 2026
- **Last Modified:** Sep 13, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:

mmc: via-sdmmc: cancel card-detect work on remove

Disabling the device interrupt and freeing the IRQ prevents new card-detect
work from being queued, but carddet_work already queued by the handler can
still run after via_sd_remove() returns. via_sdc_card_detect() recovers the
host through container_of() and dereferences its MMIO base; once remove()
returns the host can be freed, so that work would touch freed memory.

Cancel carddet_work after freeing the IRQ and before cancelling
finish_bh_work, which the card-detect handler can also queue. carddet_work
can re-enable the interrupt through via_reset_pcictrl(); mask it again
afterwards.

This issue was found by an in-house static analysis tool and confirmed by
manual code review.

## Affected Products

- Linux — Linux (f0bf7f61b8405224bc52fc9a3ccd167a68126e00)
- Linux — Linux (2.6.31)
- Linux — Linux (0)
- Linux — Linux (6.18.50)
- Linux — Linux (7.2.4)
- Linux — Linux (7.3-rc1)

## References

- [CNA](https://git.kernel.org/stable/c/f7ff3027ef004a331ef911a4886f12bc2e996037)
- [CNA](https://git.kernel.org/stable/c/eaca730c6f5e3609df62a0469fb789235a93d276)
- [CNA](https://git.kernel.org/stable/c/57e5d877f898d5e5c9d672a77bb6bdd24f0d9bf5)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.13%
- **EPSS Percentile:** 2.7

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._