{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-72073 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-72073 is an use after free vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-72073 and fix it if it is affected.\n\nWhat it is: CVE-2026-72073 is an use after free vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-72073 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-72073/ (Markdown: https://insights.sbomify.com/CVE-2026-72073/index.md)","id":"CVE-2026-72073","markdown":"https://insights.sbomify.com/CVE-2026-72073/index.md","name":"CVE-2026-72073","record":{"aliases":["AZL-96525","BELL-CVE-2026-72073","DEBIAN-CVE-2026-72073","GHSA-2w4f-22fv-v9w4","UBUNTU-CVE-2026-72073"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel driver","requires_auth":"none","summary":"A use-after-free vulnerability in the Linux kernel vub300 MMC driver allows local attackers to potentially execute code or cause a denial of service via a race condition during probe failure.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: vub300: fix use-after-free on probe failure\n\nThe vub300 driver lifetime-manages its controller state using\nvub300-\u003ekref, with vub300_delete() freeing the mmc host when the last\nreference is dropped. The probe error path after the inactivity timer has\nbeen armed still bypasses that lifetime rule, however, and falls through\nto mmc_free_host() directly if mmc_add_host() fails.\n\nThe race window is between arming the inactivity timer and reaching the\nprobe error unwind after mmc_add_host() fails:\n\n        probe thread                     timer/workqueue\n        ------------                     ---------------\n        kref_init(\u0026vub300-\u003ekref)         ref = 1\n        kref_get(\u0026vub300-\u003ekref)          ref = 2, timer ref\n        add_timer(inactivity_timer)      fires after one second\n        |\n        |   race window\n        |\u003c----------------------------------------------------\u003e\n        |\n        mmc_add_host(mmc)\n                                         inactivity timer fires\n                                         vub300_queue_dead_work()\n                                           kref_get()          ref = 3\n                                           queue_work(deadwork)\n        mmc_add_host() fails\n        timer_delete_sync()\n        mmc_free_host(mmc)\n          frees vub300\n                                         deadwork runs\n                                           use-after-free\n\nThe inactivity timeout is one second, so this would require\nmmc_add_host() to both fail and take more than one second to do so. This\nis unlikely to happen in practice, but the error path is still wrong.\n\ntimer_delete_sync() only waits for the timer callback itself. It does\nnot flush deadwork that the callback may already have queued. As a\nresult, queued deadwork can still hold a kref while the probe error path\ndirectly frees the backing mmc host, including the vub300 storage.\n\nFix this by using the same lifetime mechanism as disconnect. Clear\nvub300-\u003einterface so that the timer callback and any queued deadwork\nreturn early and drop their references, then drop the initial probe\nreference and return without falling through to err_free_host.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"mmc: vub300: fix use-after-free on probe failure","id":"CVE-2026-72073","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"Input: ims-pcu - fix type confusion in CDC union descriptor parsing","id":"CVE-2026-72074"},"packages":[],"prev":{"headline":"net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete","id":"CVE-2026-72072"},"products":["Linux"],"published":"2026-08-15","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-21","vendors":["Linux"]},"summary":"A use-after-free vulnerability in the Linux kernel vub300 MMC driver allows local attackers to potentially execute code or cause a denial of service via a race condition during probe failure.","url":"https://insights.sbomify.com/CVE-2026-72073/"}