CVE-2026-74642: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
The recent fix for UAF in umptoendpoint() caused another UAF because it tries to dereference the UMP endpoint object, but this might be executed at a delayed context where the endpoint has been already released.
Add privatefree to clear the associated data for avoiding the further dereference for delayed releases.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.152 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.104 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.45 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.1.9
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the Linux kernel with ALSA USB MIDI 2.0 endpoint handling are exposed when delayed endpoint release can occur. The issue involves UMP endpoint data being dereferenced after the endpoint object has already been released.
What condition triggers the use-after-free?
The vulnerable path occurs when delayed release processing runs after a MIDI2/UMP endpoint has been released. The earlier UAF fix in ump_to_endpoint() could still dereference the associated endpoint object in that delayed context.
What does the fix change?
The fix adds private_free handling to clear associated data during endpoint cleanup. This prevents later delayed-release processing from dereferencing stale endpoint data.