CVE-2026-74642: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs

Published Aug 22, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb: Fix UAF at delayed release of MIDI2 EPs

The recent fix for UAF in umptoendpoint() caused another UAF because it tries to dereference the UMP endpoint object, but this might be executed at a delayed context where the endpoint has been already released.

Add privatefree to clear the associated data for avoiding the further dereference for delayed releases.

Event History

Aug 22, 2026

CVE Published

via MITRE·03:32 PM

Data Sourced

via MITRE·03:32 PM

Description

Data Sourced

via NVD·04:16 PM

Description

Frequently Asked Questions

Which systems are exposed to this issue?

Systems running the Linux kernel with ALSA USB MIDI 2.0 endpoint handling are exposed when delayed endpoint release can occur. The issue involves UMP endpoint data being dereferenced after the endpoint object has already been released.

What condition triggers the use-after-free?

The vulnerable path occurs when delayed release processing runs after a MIDI2/UMP endpoint has been released. The earlier UAF fix in ump_to_endpoint() could still dereference the associated endpoint object in that delayed context.

What does the fix change?

The fix adds private_free handling to clear associated data during endpoint cleanup. This prevents later delayed-release processing from dereferencing stale endpoint data.

CVE-2026-74642: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What condition triggers the use-after-free?

What does the fix change?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What condition triggers the use-after-free?

What does the fix change?