Bug 2461437 (CVE-2026-31650)

Summary:	CVE-2026-31650 kernel: mmc: vub300: fix use-after-free on disconnect
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the `vub300` driver within the Linux kernel. This vulnerability is a memory management issue where the system attempts to use memory that has already been freed, known as a 'use-after-free' error. This can happen when the driver is disconnected, potentially leading to system crashes or a denial of service. Additionally, the driver's incorrect handling of memory resources can cause memory leaks, which might degrade system performance over time.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-04-24 15:01:27 UTC

In the Linux kernel, the following vulnerability has been resolved:

mmc: vub300: fix use-after-free on disconnect

The vub300 driver maintains an explicit reference count for the
controller and its driver data and the last reference can in theory be
dropped after the driver has been unbound.

This specifically means that the controller allocation must not be
device managed as that can lead to use-after-free.

Note that the lifetime is currently also incorrectly tied the parent USB
device rather than interface, which can lead to memory leaks if the
driver is unbound without its device being physically disconnected (e.g.
on probe deferral).

Fix both issues by reverting to non-managed allocation of the controller.

Comment 1 Keith Grant 2026-04-24 21:53:01 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026042400-CVE-2026-31650-fb3f@gregkh/T