CVE-2026-80556

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition<br /> <br /> In atmci_probe, &amp;host-&gt;bh_work is bound with atmci_work_func, and<br /> atmci_interrupt, atmci_timeout_timer and atmci_dma_complete can all<br /> queue this work on system_bh_wq.<br /> <br /> If we remove the module, atmci_remove makes cleanup and the memory<br /> allocated for host with devm_kzalloc() is released after the remove<br /> callback returns, while the work mentioned above may still be pending<br /> or running. The sequence of operations that may lead to a UAF bug is<br /> as follows:<br /> <br /> CPU0 CPU1<br /> <br /> | atmci_interrupt<br /> | queue_work(system_bh_wq,<br /> | &amp;host-&gt;bh_work)<br /> atmci_remove |<br /> atmci_cleanup_slot(...) |<br /> atmci_writel(host, ATMCI_IDR, ~0UL) |<br /> timer_delete_sync(&amp;host-&gt;timer) |<br /> dma_release_channel(host-&gt;dma.chan) |<br /> free_irq(platform_get_irq(pdev, 0), host) |<br /> | atmci_work_func<br /> | // use host<br /> // devm resources released after |<br /> // remove returns, host is freed |<br /> | // use host (use-after-free)<br /> <br /> Fix it by canceling the work after all the sources that can schedule<br /> it (IRQ handler, timeout timer and DMA completion callback) have been<br /> stopped, and before proceeding with the remaining cleanup in<br /> atmci_remove.