CVE-2026-72073

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the vub300 driver. The driver manages controller state lifetime using vub300->kref, where vub300 delete() frees the mmc host once the last reference is dropped. However, the probe error path bypasses this rule and calls mmc free host() directly if mmc add host() fails after the inactivity timer has been armed. Because timer delete sync() only waits for the timer callback and does not flush queued deadwork, a race condition occurs where queued deadwork may attempt to access the vub300 storage after it has been freed by the probe error path.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.