CVE-2026-72073 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution vendors, and users of the affected Linux kernel versions should be aware of this vulnerability and take steps to patch their systems. The vulnerability requires immediate attention to prevent potential crashes or code execution. Linux kernel maintainers and users should prioritize patching and review system logs for potential exploitation attempts.

Technical summary

The vub300 driver in the Linux kernel has a use-after-free vulnerability. When the inactivity timer is armed and mmc_add_host() fails, the probe error path can lead to a use-after-free condition. This is because timer_delete_sync() only waits for the timer callback and does not flush any queued deadwork. As a result, the queued deadwork can still hold a reference to the vub300 storage while the probe error path directly frees the backing mmc host. The vulnerability can be triggered when the inactivity timeout is one second, and mmc_add_host() fails and takes more than one second to do so. However, this is unlikely to happen in practice. The error path is still wrong, and the fix involves using the same lifetime mechanism as disconnect.

Defensive priority

This use-after-free vulnerability in the Linux kernel's vub300 driver requires immediate attention to prevent potential crashes or code execution. Linux kernel maintainers and users should prioritize patching.

Recommended defensive actions

• Apply the patch from the Linux kernel repository
• Review and update Linux kernel configurations
• Monitor system logs for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further analysis of the Linux kernel source code and the vub300 driver is necessary to fully understand the issue. The vub300 driver's use-after-free vulnerability can be triggered when the inactivity timer is armed and mmc_add_host() fails, leading to a potential crash or code execution. Linux kernel maintainers and users should prioritize patching and review system logs for potential exploitation attempts. The patch from the Linux kernel repository should be applied as soon as possible.

Official resources