CVE-2026-98209

What it actually does

Use-after-free condition arises when SDHCI child platform devices remain registered after the parent ASPEED SDC clock and managed resources have been released during probe failure or driver removal paths.

Why it matters to the business

Systems using affected ASPEED MMC controllers may experience kernel instability, crashes, or undefined behavior during device initialization or hot-plug events, potentially affecting boot reliability in embedded and server platforms.

How an attack unfolds

An attacker with local access triggers repeated probe failures or module removal on the sdhci-of-aspeed driver; the lingering child devices then reference freed clock and resource structures, leading to a use-after-free that can be leveraged for memory corruption.

How to fix it

Update to a kernel containing the fix that calls of_platform_device_destroy on children in reverse order before disabling the parent clock; backport the change to any long-term supported kernels still shipping the buggy sdhci-of-aspeed driver.

How to confirm the fix worked

Confirm the presence of the upstream commit that adds the reverse-order of_platform_device_destroy calls before clock disable on both probe-error and remove paths; inspect the driver source for the corrected ordering.

Typical attack path

1. Obtain local access on a system with the vulnerable sdhci-of-aspeed driver loaded
2. Induce probe failure or trigger driver unbind/remove operations
3. Force the parent clock and managed resources to be released while child OF devices remain registered
4. Reference the dangling child device structures to trigger the use-after-free
5. Escalate via memory corruption primitives if the UAF is exploitable

How to detect it

Review kernel logs for oops or panic messages referencing sdhci-of-aspeed, clock disable, or platform device release during module unload or probe failure; correlate with recent driver bind/unbind activity.

What your security team should do

• Prioritize kernel updates on any ASPEED-based embedded or server platforms that expose MMC/SD controllers
• Monitor upstream stable and distribution kernels for the backported patch
• Limit unprivileged local access on affected systems until patched