CVE-2026-89441

In the Linux kernel, the following vulnerability has been resolved:

mmc: via-sdmmc: cancel card-detect work on remove

Disabling the device interrupt and freeing the IRQ prevents new card-detect work from being queued, but carddet work already queued by the handler can still run after via sd remove() returns. via sdc card detect() recovers the host through container of() and dereferences its MMIO base; once remove() returns the host can be freed, so that work would touch freed memory.

Cancel carddet work after freeing the IRQ and before cancelling finish bh work, which the card-detect handler can also queue. carddet work can re-enable the interrupt through via reset pcictrl(); mask it again afterwards.

This issue was found by an in-house static analysis tool and confirmed by manual code review.