CVE-2026-90022: usb: gadget: f_midi2: fix use-after-free in string attribute show path
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: fmidi2: fix use-after-free in string attribute show path
fmidi2optsstrshow() takes the string lock internally, but its callers dereference the opts->info.<field> pointer before calling it, outside the lock. This races with fmidi2optsstrstore(), which frees the old string under opts->lock when the attribute is written concurrently, the show path can read a pointer that gets freed before the lock inside strshow() is even taken.
Change fmidi2optsstrshow() to take a pointer to the string field, matching the existing pattern in fmidi2optsstrstore(), and dereference it only after the lock is held. Update all three callers (ifacename, block name, and the EP string option macro) accordingly.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the use-after-free?
The affected f_midi2 string attribute must be read while the same string option is concurrently written. The race occurs because the read path can dereference the existing string pointer before acquiring the lock, while the write path frees the old string under that lock.
Which configuration attributes are involved?
The fix updates the show-path callers for the iface_name and block name attributes, as well as the endpoint string option handled through the EP string option macro.
How can I determine whether a kernel contains the fix?
Check whether the f_midi2 string show helper was changed to receive a pointer to the string field and dereference it only after taking opts->lock. The linked stable commits provide the corresponding fixes.