CVE-2026-31650 mmc: vub300: fix use-after-free on disconnect
A use-after-free vulnerability in the Linux kernel vub300 MMC driver allows attackers to cause denial of service or execute code via device disconnection.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31650?
CVE-2026-31650 is a high-severity use after free vulnerability in Linux kernel, published on 24 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mmc: vub300: fix use-after-free on disconnect
The vub300 driver maintains an explicit reference count for the controller and its driver data and the last reference can in theory be dropped after the driver has been unbound.
This specifically means that the controller allocation must not be device managed as that can lead to use-after-free.
Note that the lifetime is currently also incorrectly tied the parent USB device rather than interface, which can lead to memory leaks if the driver is unbound without its device being physically disconnected (e.g. on probe deferral).
Fix both issues by reverting to non-managed allocation of the controller.
Weakness: CWE-416
Which versions are affected by CVE-2026-31650?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31650?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-31650 being exploited?
There is no known exploitation of CVE-2026-31650 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-31650, DEBIAN-CVE-2026-31650, GHSA-f2r4-35m8-fgwm, UBUNTU-CVE-2026-31650.