The Linux kernel via-sdmmc driver improperly handles probe failure after registering the SD card-detect interrupt via request_irq(). If mmc_add_host() fails, the error path does not free the interrupt, causing the interrupt handler via_sdc_isr() to run against freed host memory and MMIO base. Additionally, carddet_work scheduled by the handler also accesses freed memory through container_of() dereferences. The fix adds a probe-error path that disables and frees the interrupt and cancels carddet_work before unmapping registers, preventing use-after-free conditions.

This vulnerability can cause the kernel interrupt handler to access freed memory, potentially leading to kernel crashes or undefined behavior. There is no information about exploitation in the wild or privilege escalation, but the flaw risks system stability and security due to use-after-free in kernel space.

A fix has been implemented in the Linux kernel source to properly disable and free the interrupt and cancel scheduled work on probe failure. Users should apply the official kernel update that includes this patch. No other mitigation steps are indicated.