CVE-2026-72073

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mmc: vub300: fix use-after-free on probe failure

The vub300 driver lifetime-manages its controller state using

vub300->kref, with vub300_delete() freeing the mmc host when the last

reference is dropped. The probe error path after the inactivity timer has

been armed still bypasses that lifetime rule, however, and falls through

to mmc_free_host() directly if mmc_add_host() fails.

The race window is between arming the inactivity timer and reaching the

probe error unwind after mmc_add_host() fails:

probe thread timer/workqueue

------------ ---------------

kref_init(&vub300->kref) ref = 1

kref_get(&vub300->kref) ref = 2, timer ref

add_timer(inactivity_timer) fires after one second

|

| race window

|<---------------------------------------------------->

|

mmc_add_host(mmc)

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References