GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89440 (GCVE-0-2026-89440)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:43 – Updated: 2026-09-14 11:59
VLAI
Title
mmc: via-sdmmc: stop card-detect handling on probe failure
Summary
In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: stop card-detect handling on probe failure request_irq() registers the SD card-detect interrupt and the probe enables it before mmc_add_host() runs. If mmc_add_host() fails, the error path only unmaps the registers and returns: the interrupt stays registered, so the handler keeps running against the host once it is freed. via_sdc_isr() dereferences sdhost and its MMIO base and schedules carddet_work, which via_sdc_card_detect() also runs against freed memory through its container_of() dereference. Add a probe-error path that disables and frees the interrupt and cancels carddet_work before unmapping. carddet_work can re-enable the device interrupt via via_reset_pcictrl(), which restores PCIINTCTRL, so mask it again after cancelling the work. This issue was found by an in-house static analysis tool and confirmed by manual code review.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 63400da6cd37a9793c19bb6aed7131b58b975a04 , < 5bb5327b92aae17e91c7228953c350a6ee3c94e8 (git)
Affected: 0959cc1685eb19774300d43ef25e318b457b156b , < d045596706d1b25d38af4a79980b017639fea9d1 (git)
Affected: ba91b413983a9235792523c6b9f7ba2586c4d75d , < 806409f12fdb14c9e4c56a64494c9b75f356cd49 (git)
Affected: e4e46fb61e3bb4628170810d3f2b996b709b90d9 , < dde5b9c91e9fc64e54a2f186d3ae95868b4dbb02 (git)
Affected: e4e46fb61e3bb4628170810d3f2b996b709b90d9 , < efe7f25dd27e35063477b4b0e7eed3675669fd99 (git)
Affected: e4e46fb61e3bb4628170810d3f2b996b709b90d9 , < 2550f89589caad7402d618d7dffc038582c94b6b (git)
Affected: e4e46fb61e3bb4628170810d3f2b996b709b90d9 , < c2b8a624911999399cc14822fec3e35032b3cee4 (git)
Affected: e4e46fb61e3bb4628170810d3f2b996b709b90d9 , < 088eaa92fcebaa6b957ccf9635afdf39643a577d (git)
Affected: 076bcd2c93e16b05c10564e299d6e5d26a766d00 (git)
Affected: 12b8e81b77c05c658efd9cde3585bbd65ae39b59 (git)
Affected: 95025a8dd0ec015872f6c16473fe04d6264e68ca (git)
Affected: f59ef2a47a228e51322ad76752a55a8917c56e38 (git)
Affected: 0ec94795114edc7e24ec71849dce42bfa61dafa3 (git)
Affected: 5.10.163 , < 5.10.270 (semver)
Affected: 5.15.86 , < 5.15.221 (semver)
Affected: 6.1.2 , < 6.1.188 (semver)
Affected: 4.9.337 , < 4.10 (semver)
Affected: 4.14.303 , < 4.15 (semver)
Affected: 4.19.270 , < 4.20 (semver)
Affected: 5.4.229 , < 5.5 (semver)
Affected: 6.0.16 , < 6.1 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/mmc/host/via-sdmmc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5bb5327b92aae17e91c7228953c350a6ee3c94e8",
              "status": "affected",
              "version": "63400da6cd37a9793c19bb6aed7131b58b975a04",
              "versionType": "git"
            },
            {
              "lessThan": "d045596706d1b25d38af4a79980b017639fea9d1",
              "status": "affected",
              "version": "0959cc1685eb19774300d43ef25e318b457b156b",
              "versionType": "git"
            },
            {
              "lessThan": "806409f12fdb14c9e4c56a64494c9b75f356cd49",
              "status": "affected",
              "version": "ba91b413983a9235792523c6b9f7ba2586c4d75d",
              "versionType": "git"
            },
            {
              "lessThan": "dde5b9c91e9fc64e54a2f186d3ae95868b4dbb02",
              "status": "affected",
              "version": "e4e46fb61e3bb4628170810d3f2b996b709b90d9",
              "versionType": "git"
            },
            {
              "lessThan": "efe7f25dd27e35063477b4b0e7eed3675669fd99",
              "status": "affected",
              "version": "e4e46fb61e3bb4628170810d3f2b996b709b90d9",
              "versionType": "git"
            },
            {
              "lessThan": "2550f89589caad7402d618d7dffc038582c94b6b",
              "status": "affected",
              "version": "e4e46fb61e3bb4628170810d3f2b996b709b90d9",
              "versionType": "git"
            },
            {
              "lessThan": "c2b8a624911999399cc14822fec3e35032b3cee4",
              "status": "affected",
              "version": "e4e46fb61e3bb4628170810d3f2b996b709b90d9",
              "versionType": "git"
            },
            {
              "lessThan": "088eaa92fcebaa6b957ccf9635afdf39643a577d",
              "status": "affected",
              "version": "e4e46fb61e3bb4628170810d3f2b996b709b90d9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "076bcd2c93e16b05c10564e299d6e5d26a766d00",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "12b8e81b77c05c658efd9cde3585bbd65ae39b59",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "95025a8dd0ec015872f6c16473fe04d6264e68ca",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f59ef2a47a228e51322ad76752a55a8917c56e38",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0ec94795114edc7e24ec71849dce42bfa61dafa3",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.270",
              "status": "affected",
              "version": "5.10.163",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.221",
              "status": "affected",
              "version": "5.15.86",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.188",
              "status": "affected",
              "version": "6.1.2",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.337",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.303",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.270",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.229",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1",
              "status": "affected",
              "version": "6.0.16",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/mmc/host/via-sdmmc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "5.10.163",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.15.86",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "6.1.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.337",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.303",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.270",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.229",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.0.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: via-sdmmc: stop card-detect handling on probe failure\n\nrequest_irq() registers the SD card-detect interrupt and the probe enables\nit before mmc_add_host() runs. If mmc_add_host() fails, the error path only\nunmaps the registers and returns: the interrupt stays registered, so the\nhandler keeps running against the host once it is freed. via_sdc_isr()\ndereferences sdhost and its MMIO base and schedules carddet_work, which\nvia_sdc_card_detect() also runs against freed memory through its\ncontainer_of() dereference.\n\nAdd a probe-error path that disables and frees the interrupt and cancels\ncarddet_work before unmapping. carddet_work can re-enable the device\ninterrupt via via_reset_pcictrl(), which restores PCIINTCTRL, so mask it\nagain after cancelling the work.\n\nThis issue was found by an in-house static analysis tool and confirmed by\nmanual code review."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The leftover IRQ use-after-free is in the VIA VT9530 PCI SD/MMC host probe path (via_sd_probe enabling via_sdc_isr before mmc_add_host) on systems that already have this onboard/PCI reader; it is not reached by network packets or USB hotplug.\nAC:L - The driver arms the shared card-detect IRQ before mmc_add_host(); a failed add leaves via_sdc_isr registered against freed sdhost indefinitely, so a local attacker who induces device_add failure (memory pressure/reprobe) and reclaims the host slab does not depend on an uncontrolled race.\nPR:L - An unprivileged local user on a machine with this PCI reader can be present when probe fails and then spray the heap while the dangling shared IRQ fires; capability-gated PCI sysfs unbind is not required for the UAF itself, so PR:L is the higher-severity defensible bar.\nUI:N - No victim action such as inserting an SD card, mounting media, or opening a file is required; after failed probe the leftover ISR and carddet_work run from hardware or shared interrupts without another user\u0027s involvement.\nS:U - The use-after-free corrupts kernel heap and IRQ/workqueue state inside the host OS; this is standard in-kernel memory corruption, not a VM escape, IOMMU/DMA isolation bypass, or other cross-authority breakout.\nC:H - via_sdc_isr spin_locks and dereferences the freed via_crdr_mmc_host (MMIO bases and status registers) and may queue carddet_work that recovers the same object via container_of(), a kernel UAF that enables arbitrary disclosure via slab reuse.\nI:H - The same UAF lets a reclaimed host object supply lock, MMIO, and work pointers used for MMIO writes, work scheduling, and via_reset_pcictrl, enabling heap spraying and control-flow hijack rather than a crash-only outcome.\nA:H - IRQ-context dereference of freed sdhost after iounmap and devm mmc_free_host causes a kernel oops or panic even without full exploitation, so availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T11:59:51.359Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5bb5327b92aae17e91c7228953c350a6ee3c94e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/d045596706d1b25d38af4a79980b017639fea9d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/806409f12fdb14c9e4c56a64494c9b75f356cd49"
        },
        {
          "url": "https://git.kernel.org/stable/c/dde5b9c91e9fc64e54a2f186d3ae95868b4dbb02"
        },
        {
          "url": "https://git.kernel.org/stable/c/efe7f25dd27e35063477b4b0e7eed3675669fd99"
        },
        {
          "url": "https://git.kernel.org/stable/c/2550f89589caad7402d618d7dffc038582c94b6b"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2b8a624911999399cc14822fec3e35032b3cee4"
        },
        {
          "url": "https://git.kernel.org/stable/c/088eaa92fcebaa6b957ccf9635afdf39643a577d"
        }
      ],
      "title": "mmc: via-sdmmc: stop card-detect handling on probe failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89440",
    "datePublished": "2026-09-11T19:43:09.402Z",
    "dateReserved": "2026-09-11T19:38:34.703Z",
    "dateUpdated": "2026-09-14T11:59:51.359Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89440",
      "date": "2026-09-16",
      "epss": "0.00164",
      "percentile": "0.05993"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89440\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:24.330\",\"lastModified\":\"2026-09-14T13:19:01.230\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmmc: via-sdmmc: stop card-detect handling on probe failure\\n\\nrequest_irq() registers the SD card-detect interrupt and the probe enables\\nit before mmc_add_host() runs. If mmc_add_host() fails, the error path only\\nunmaps the registers and returns: the interrupt stays registered, so the\\nhandler keeps running against the host once it is freed. via_sdc_isr()\\ndereferences sdhost and its MMIO base and schedules carddet_work, which\\nvia_sdc_card_detect() also runs against freed memory through its\\ncontainer_of() dereference.\\n\\nAdd a probe-error path that disables and frees the interrupt and cancels\\ncarddet_work before unmapping. carddet_work can re-enable the device\\ninterrupt via via_reset_pcictrl(), which restores PCIINTCTRL, so mask it\\nagain after cancelling the work.\\n\\nThis issue was found by an in-house static analysis tool and confirmed by\\nmanual code review.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/mmc/host/via-sdmmc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"63400da6cd37a9793c19bb6aed7131b58b975a04\",\"lessThan\":\"5bb5327b92aae17e91c7228953c350a6ee3c94e8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0959cc1685eb19774300d43ef25e318b457b156b\",\"lessThan\":\"d045596706d1b25d38af4a79980b017639fea9d1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ba91b413983a9235792523c6b9f7ba2586c4d75d\",\"lessThan\":\"806409f12fdb14c9e4c56a64494c9b75f356cd49\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e4e46fb61e3bb4628170810d3f2b996b709b90d9\",\"lessThan\":\"dde5b9c91e9fc64e54a2f186d3ae95868b4dbb02\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e4e46fb61e3bb4628170810d3f2b996b709b90d9\",\"lessThan\":\"efe7f25dd27e35063477b4b0e7eed3675669fd99\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e4e46fb61e3bb4628170810d3f2b996b709b90d9\",\"lessThan\":\"2550f89589caad7402d618d7dffc038582c94b6b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e4e46fb61e3bb4628170810d3f2b996b709b90d9\",\"lessThan\":\"c2b8a624911999399cc14822fec3e35032b3cee4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e4e46fb61e3bb4628170810d3f2b996b709b90d9\",\"lessThan\":\"088eaa92fcebaa6b957ccf9635afdf39643a577d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"076bcd2c93e16b05c10564e299d6e5d26a766d00\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"12b8e81b77c05c658efd9cde3585bbd65ae39b59\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"95025a8dd0ec015872f6c16473fe04d6264e68ca\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f59ef2a47a228e51322ad76752a55a8917c56e38\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0ec94795114edc7e24ec71849dce42bfa61dafa3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.10.163\",\"lessThan\":\"5.10.270\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.86\",\"lessThan\":\"5.15.221\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.2\",\"lessThan\":\"6.1.188\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.9.337\",\"lessThan\":\"4.10\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.14.303\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.19.270\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.4.229\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.0.16\",\"lessThan\":\"6.1\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/mmc/host/via-sdmmc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.270\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/088eaa92fcebaa6b957ccf9635afdf39643a577d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2550f89589caad7402d618d7dffc038582c94b6b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5bb5327b92aae17e91c7228953c350a6ee3c94e8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/806409f12fdb14c9e4c56a64494c9b75f356cd49\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c2b8a624911999399cc14822fec3e35032b3cee4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d045596706d1b25d38af4a79980b017639fea9d1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dde5b9c91e9fc64e54a2f186d3ae95868b4dbb02\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/efe7f25dd27e35063477b4b0e7eed3675669fd99\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T21:44:11+00:00",
      "cve": "CVE-2026-89440",
      "id": "CVE-2026-89440",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "199",
      "product_status:known_not_affected": "77",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mmc: via-sdmmc: stop card-detect handling on probe failure",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89440.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T00:59:23Z",
      "cve": "CVE-2026-89440",
      "id": "CVE-2026-89440",
      "initial_release_date": "2026-09-12T16:28:26Z",
      "product_status:known_affected": "126",
      "product_status:known_not_affected": "227",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89440",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89440.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.