CVE-2026-74501: ALSA: usb-audio: fix use-after-free in ump_to_endpoint()
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: fix use-after-free in umptoendpoint()
createmidi2ump() registers a card-owned sndumpendpoint and stores a back-pointer to its per-interface sndusbmidi2ump object in ump->privatedata, but it never installs an ump->privatefree hook and never clears that pointer.
If a later step of sndusbmidiv2create() fails, its error path calls freeallmidi2umps(), which kfree()s the sndusbmidi2ump object while the already-registered endpoint keeps pointing at it. The created /dev/snd/umpCD node stays exposed, so the first operation of any UMP open, umptoendpoint(), dereferences the dangling ump->privatedata and reads rmidi->eps[dir] out of freed memory.
A malicious USB MIDI 2.0 device that makes creation fail after the endpoint is registered can thus trigger a slab use-after-free read on a subsequent open of the UMP node.
Clear the endpoint's back-pointer before freeing the object, and let umptoendpoint() tolerate a NULL privatedata so the open/close/trigger callbacks fail cleanly (their callers already handle a NULL endpoint) instead of dereferencing a stale pointer.
Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the ALSA usb-audio code path, clear the created endpoint’s back-pointer to the per-interface snd_usb_midi2_ump object before freeing the snd_usb_midi2_ump, and ensure the callbacks/error paths fail cleanly without leaving a dangling pointer (so ump_to_endpoint() does not dereference freed memory).
Linux kernel ALSA usb-audio (function ump_to_endpoint / snd_usb_midi_v2_create) Fix use-after-free by clearing endpoint back-pointer before freeing the snd_usb_midi2_ump object = Apply the resolution that clears the per-interface back-pointer and prevents stale dereference on open/close/trigger paths
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74501?
CVE-2026-74501 has a risk severity rating of 33.
What type of vulnerability is CVE-2026-74501?
CVE-2026-74501 is classified as a Use After Free vulnerability.
How do I fix CVE-2026-74501?
To fix CVE-2026-74501, you should update the Linux kernel to the latest version where this vulnerability has been patched.
What impact does CVE-2026-74501 have on systems?
CVE-2026-74501 can potentially lead to application crashes or arbitrary code execution due to the use-after-free condition.
What software is affected by CVE-2026-74501?
CVE-2026-74501 affects the ALSA subsystem of the Linux kernel, particularly the usb-audio component.