CVE-2026-90021: usb: gadget: f_midi: initialize work in f_midi_alloc()
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: fmidi: initialize work in fmidialloc()
fmidialloc initializes freeref to 1 and it can only be incremented when a sound card is registered via fmidiregistercard(). fmidiregistercard() is only called in fmidibind() which actually performs INITWORK. If fmidibind() is never run, work is not initialized and the if condition in fmidifree becomes true, this results in a warning later in flushwork as work->func = 0. Fix this by moving INITWORK from fmidibind() to fmidialloc().
Affected Software
Event History
Frequently Asked Questions
Under what condition does the issue occur?
It occurs when an f_midi instance is allocated but f_midi_bind() is never run. In that path, the work item remains uninitialized and f_midi_free() can later cause a warning in __flush_work because work->func is zero.
What component or configuration path is involved?
The affected code is the Linux kernel USB gadget MIDI function, f_midi. The problematic path is specifically one where allocation occurs without subsequently binding the function and registering its sound card.
What does the fix change?
The fix moves INIT_WORK from f_midi_bind() into f_midi_alloc(). This ensures the work item is initialized as soon as the f_midi object is allocated, including when binding never occurs.