CVE-2026-89440

In the Linux kernel, the following vulnerability has been resolved:

mmc: via-sdmmc: stop card-detect handling on probe failure

request irq() registers the SD card-detect interrupt and the probe enables it before mmc add host() runs. If mmc add host() fails, the error path only unmaps the registers and returns: the interrupt stays registered, so the handler keeps running against the host once it is freed. via sdc isr() dereferences sdhost and its MMIO base and schedules carddet work, which via sdc card detect() also runs against freed memory through its container of() dereference.

Add a probe-error path that disables and frees the interrupt and cancels carddet work before unmapping. carddet work can re-enable the device interrupt via via reset pcictrl(), which restores PCIINTCTRL, so mask it again after cancelling the work.

This issue was found by an in-house static analysis tool and confirmed by manual code review.