https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 18:06:45 +0000 https://vulnerability.circl.lu/vuln/cve-2026-72073 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>mmc: vub300: fix use-after-free on probe failure</p> <p>The vub300 driver lifetime-manages its controller state using vub300-&gt;kref, with vub300_delete() freeing the mmc host when the last reference is dropped. The probe error path after the inactivity timer has been armed still bypasses that lifetime rule, however, and falls through to mmc_free_host() directly if mmc_add_host() fails.</p> <p>The race window is between arming the inactivity timer and reaching the probe error unwind after mmc_add_host() fails:</p> <p>probe thread timer/workqueue ------------ --------------- kref_init(&amp;vub300-&gt;kref) ref = 1 kref_get(&amp;vub300-&gt;kref) ref = 2, timer ref add_timer(inactivity_timer) fires after one second | | race window |&lt;----------------------------------------------------&gt; | mmc_add_host(mmc) inactivity timer fires vub300_queue_dead_work() kref_get() ref = 3 queue_work(deadwork) mmc_add_host() fails timer_delete_sync() mmc_free_host(mmc) frees vub300 deadwork runs use-after-free</p> <p>The inactivity timeo…</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>mmc: vub300: fix use-after-free on probe failure</p> <p>The vub300 driver lifetime-manages its controller state using vub300-&gt;kref, with vub300_delete() freeing the mmc host when the last reference is dropped. The probe error path after the inactivity timer has been armed still bypasses that lifetime rule, however, and falls through to mmc_free_host() directly if mmc_add_host() fails.</p> <p>The race window is between arming the inactivity timer and reaching the probe error unwind after mmc_add_host() fails:</p> <p>probe thread timer/workqueue ------------ --------------- kref_init(&amp;vub300-&gt;kref) ref = 1 kref_get(&amp;vub300-&gt;kref) ref = 2, timer ref add_timer(inactivity_timer) fires after one second | | race window |&lt;----------------------------------------------------&gt; | mmc_add_host(mmc) inactivity timer fires vub300_queue_dead_work() kref_get() ref = 3 queue_work(deadwork) mmc_add_host() fails timer_delete_sync() mmc_free_host(mmc) frees vub300 deadwork runs use-after-free</p> <p>The inactivity timeo…</p> https://vulnerability.circl.lu/vuln/cve-2026-72073