CVE-2026-72073 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
mmc: vub300: fix use-after-free on probe failure
The vub300 driver lifetime-manages its controller state using vub300->kref, with vub300_delete() freeing the mmc host when the last reference is dropped. The probe error path after the inactivity timer has been armed still bypasses that lifetime rule, however, and falls through to mmc_free_host() directly if mmc_add_host() fails.
The race window is between arming the inactivity timer and reaching the probe error unwind after mmc_add_host() fails:
probe thread timer/workqueue ------------ --------------- kref_init(&vub300->kref) ref = 1 kref_get(&vub300->kref) ref = 2, timer ref add_timer(inactivity_timer) fires after one second | | race window |<----------------------------------------------------> | mmc_add_host(mmc) inactivity timer fires vub300_queue_dead_work() kref_get() ref = 3 queue_work(deadwork) mmc_add_host() fails timer_delete_sync() mmc_free_host(mmc) frees vub300 deadwork runs use-after-free
The inactivity timeout is one second, so this would require mmc_add_host() to both fail and take more than one second to do so. This is unlikely to happen in practice, but the error path is still wrong.
timer_delete_sync() only waits for the timer callback itself. It does not flush deadwork that the callback may already have queued. As a result, queued deadwork can still hold a kref while the probe error path directly frees the backing mmc host, including the vub300 storage.
Fix this by using the same lifetime mechanism as disconnect. Clear vub300->interface so that the timer callback and any queued deadwork return early and drop their references, then drop the initial probe reference and return without falling through to err_free_host.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in question affects the linux kernel's mmc vub300 driver where a use-after-free condition can occur during probe failure scenarios. This flaw arises from improper lifetime management of the driver's controller state, which relies on kernel reference counting through vub300->kref to control when the mmc host is freed. When the inactivity timer has been armed but mmc_add_host() subsequently fails, the error path bypasses the established lifetime rules and directly calls mmc_free_host() instead of properly utilizing the reference counting mechanism.
The race condition manifests between the moment when the inactivity timer is armed and when the probe error unwind occurs after mmc_add_host() fails. During this window, which spans approximately one second due to the timer's one-second timeout, multiple execution paths can interfere with each other. The sequence begins with kref_init() initializing the reference count to one, followed by kref_get() incrementing it to two as the timer reference is acquired. Once add_timer() arms the inactivity timer, the system enters a critical race window where concurrent operations can lead to unpredictable behavior.
The problematic execution flow involves mmc_add_host() failing while the timer callback may already have been queued through vub300_queue_dead_work(). When this occurs, the timer callback executes vub300_queue_dead_work() which calls kref_get() to increment the reference count to three, then queues deadwork for execution. However, when mmc_add_host() fails, the probe error path directly invokes mmc_free_host() without properly cleaning up references, creating a situation where queued deadwork still holds valid references while the underlying memory has been freed.
This particular vulnerability aligns with CWE-416 which addresses use-after-free conditions in software systems. The race window duration of approximately one second makes exploitation unlikely in typical environments but represents a fundamental flaw in the driver's error handling architecture. The issue is particularly concerning because timer_delete_sync() only waits for the timer callback itself to complete and does not flush any work items that may have already been queued, leaving potential for dangling references.
The fix implements a proper lifetime management approach consistent with how disconnect scenarios are handled within the same driver. Rather than directly freeing the mmc host in error paths, the solution clears vub300->interface to ensure that both the timer callback and any queued deadwork will return early without attempting to increment references on already freed resources. This approach ensures proper reference counting by dropping the initial probe reference and returning cleanly from the probe function instead of falling through to the err_free_host path, thereby maintaining consistency with the established reference counting patterns used throughout the driver's lifecycle management.
The resolution addresses core operational impacts including potential system crashes, data corruption, or privilege escalation scenarios that could arise from improper memory management. This fix brings the vub300 driver's error handling in line with standard kernel practices for managing device driver lifecycles and prevents race conditions that could be exploited by malicious actors to compromise system integrity. The implementation follows established ATT&CK techniques for kernel-level exploitation prevention by ensuring proper resource cleanup and reference counting during failure scenarios, particularly relevant for threat actors targeting embedded systems or mobile devices that utilize this specific mmc controller driver.