{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "0613ad2401f88bdeae5594c30afe318e93b14676"
            },
            {
              "fixed": "5b82af744e06cd741938c3da54fdbe564a7e52d9"
            },
            {
              "fixed": "618cf6b139503ec18ef93ffd663396aaf99b763a"
            },
            {
              "fixed": "a3b5f242997a3be7404112fd48784881560aea57"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "41ed46bdbd2878cd6567abe0974a445f8b1b8ec8"
            },
            {
              "last_affected": "25f05d762ca5e1c685002a53dd44f68e78ca3feb"
            },
            {
              "last_affected": "a46e681151bbdacdf6b89ee8c4e5bad0555142bb"
            },
            {
              "last_affected": "3b29f8769d32016b2d89183db4d80c7a71b7e35e"
            },
            {
              "last_affected": "3049a3b927a40d89d4582ff1033cd7953be773c7"
            },
            {
              "last_affected": "afc898019e7bf18c5eb7a0ac19852fcb1b341b3c"
            },
            {
              "last_affected": "c9e85979b59cb86f0a15defa8199d740e2b36b90"
            },
            {
              "last_affected": "2044b2ea77945f372ef161d1bbf814e471767ff2"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "4.9.337"
            },
            {
              "fixed": "4.10"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "4.14.303"
            },
            {
              "fixed": "4.15"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "4.19.270"
            },
            {
              "fixed": "4.20"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "5.4.229"
            },
            {
              "fixed": "5.5"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "5.10.163"
            },
            {
              "fixed": "5.11"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "5.15.86"
            },
            {
              "fixed": "5.16"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.0.16"
            },
            {
              "fixed": "6.1"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.1.2"
            },
            {
              "fixed": "6.2"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.2.0"
            },
            {
              "fixed": "6.18.42"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.1.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72073.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: vub300: fix use-after-free on probe failure\n\nThe vub300 driver lifetime-manages its controller state using\nvub300-\u003ekref, with vub300_delete() freeing the mmc host when the last\nreference is dropped. The probe error path after the inactivity timer has\nbeen armed still bypasses that lifetime rule, however, and falls through\nto mmc_free_host() directly if mmc_add_host() fails.\n\nThe race window is between arming the inactivity timer and reaching the\nprobe error unwind after mmc_add_host() fails:\n\n        probe thread                     timer/workqueue\n        ------------                     ---------------\n        kref_init(\u0026vub300-\u003ekref)         ref = 1\n        kref_get(\u0026vub300-\u003ekref)          ref = 2, timer ref\n        add_timer(inactivity_timer)      fires after one second\n        |\n        |   race window\n        |\u003c----------------------------------------------------\u003e\n        |\n        mmc_add_host(mmc)\n                                         inactivity timer fires\n                                         vub300_queue_dead_work()\n                                           kref_get()          ref = 3\n                                           queue_work(deadwork)\n        mmc_add_host() fails\n        timer_delete_sync()\n        mmc_free_host(mmc)\n          frees vub300\n                                         deadwork runs\n                                           use-after-free\n\nThe inactivity timeout is one second, so this would require\nmmc_add_host() to both fail and take more than one second to do so. This\nis unlikely to happen in practice, but the error path is still wrong.\n\ntimer_delete_sync() only waits for the timer callback itself. It does\nnot flush deadwork that the callback may already have queued. As a\nresult, queued deadwork can still hold a kref while the probe error path\ndirectly frees the backing mmc host, including the vub300 storage.\n\nFix this by using the same lifetime mechanism as disconnect. Clear\nvub300-\u003einterface so that the timer callback and any queued deadwork\nreturn early and drop their references, then drop the initial probe\nreference and return without falling through to err_free_host.",
  "id": "CVE-2026-72073",
  "modified": "2026-08-18T03:31:02.884340094Z",
  "published": "2026-08-15T05:52:24.676Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5b82af744e06cd741938c3da54fdbe564a7e52d9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/618cf6b139503ec18ef93ffd663396aaf99b763a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a3b5f242997a3be7404112fd48784881560aea57"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72073.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72073"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "mmc: vub300: fix use-after-free on probe failure"
}