https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 16:43:47 +0000 https://vulnerability.circl.lu/vuln/cve-2026-80556 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition</p> <p>In atmci_probe, &amp;host-&gt;bh_work is bound with atmci_work_func, and atmci_interrupt, atmci_timeout_timer and atmci_dma_complete can all queue this work on system_bh_wq.</p> <p>If we remove the module, atmci_remove makes cleanup and the memory allocated for host with devm_kzalloc() is released after the remove callback returns, while the work mentioned above may still be pending or running. The sequence of operations that may lead to a UAF bug is as follows:</p> <p>CPU0 CPU1</p> <p>| atmci_interrupt | queue_work(system_bh_wq, | &amp;host-&gt;bh_work) atmci_remove | atmci_cleanup_slot(...) | atmci_writel(host, ATMCI_IDR, ~0UL) | timer_delete_sync(&amp;host-&gt;timer) | dma_release_channel(host-&gt;dma.chan) | free_irq(platform_get_irq(pdev, 0), host) | | atmci_work_func | // use host // devm resources released after | // remove returns, host is freed | | // use host (use-after-free)</p> <p>Fix it by canceling the work after all the sources that can schedule it (IRQ handler, timeout timer and DMA com…</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition</p> <p>In atmci_probe, &amp;host-&gt;bh_work is bound with atmci_work_func, and atmci_interrupt, atmci_timeout_timer and atmci_dma_complete can all queue this work on system_bh_wq.</p> <p>If we remove the module, atmci_remove makes cleanup and the memory allocated for host with devm_kzalloc() is released after the remove callback returns, while the work mentioned above may still be pending or running. The sequence of operations that may lead to a UAF bug is as follows:</p> <p>CPU0 CPU1</p> <p>| atmci_interrupt | queue_work(system_bh_wq, | &amp;host-&gt;bh_work) atmci_remove | atmci_cleanup_slot(...) | atmci_writel(host, ATMCI_IDR, ~0UL) | timer_delete_sync(&amp;host-&gt;timer) | dma_release_channel(host-&gt;dma.chan) | free_irq(platform_get_irq(pdev, 0), host) | | atmci_work_func | // use host // devm resources released after | // remove returns, host is freed | | // use host (use-after-free)</p> <p>Fix it by canceling the work after all the sources that can schedule it (IRQ handler, timeout timer and DMA com…</p> https://vulnerability.circl.lu/vuln/cve-2026-80556