CVE-2026-90024: usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: midi2: Fix null-pointer dereference in fmidi2freeepreqs
A null-pointer dereference occurs in fmidi2freeepreqs() when attempting to clean up an endpoint that was never initialized.
When configuring the MIDI 2.0 gadget via configfs and setting the block direction to SNDRVUMPDIRINPUT, the initialization of the midi1epout endpoint is explicitly skipped during the gadget bind phase (fmidi2bind()). As a result, the usbep->card field remains NULL.
Later, when the host sets the alternate setting, fmidi2setalt() unconditionally stops both the IN and OUT endpoints by calling fmidi2stopeps(), which in turn calls fmidi2freeepreqs() for both endpoints. When fmidi2freeepreqs() is called for the uninitialized midi1epout, it attempts to dereference usbep->card to determine the number of requests to free, leading to a crash.
Fix this by using usbep->numreqs instead of usbep->card->info.numreqs in fmidi2freeepreqs(). usbep->numreqs is correctly set during fmidi2initep() and remains 0 if the endpoint was never initialized, safely avoiding the loop. For consistency, apply the same change to fmidi2allocepreqs().
Oops: general protection fault, probably for non-canonical address 0xdffffc00000000ee: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000770-0x0000000000000777] ... RIP: 0010:fmidi2freeepreqs drivers/usb/gadget/function/fmidi2.c:1166 [inline] RIP: 0010:fmidi2stopeps+0x28e/0x4d0 drivers/usb/gadget/function/fmidi2.c:1246 ... Call Trace: <TASK> fmidi2setalt+0x11c/0xf00 drivers/usb/gadget/function/fmidi2.c:1296 compositesetup+0x1ffd/0x3480 drivers/usb/gadget/composite.c:1933 configfscompositesetup+0xbd/0x100 drivers/usb/gadget/configfs.c:1877
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update f_midi2_free_ep_reqs() to use usb_ep->num_reqs (instead of usb_ep->card->info.num_reqs), and apply the same change to the other location(s) mentioned in the patch text so endpoint cleanup does not dereference usb_ep->card when it remains NULL.
Linux kernel USB gadget function: f_midi2 (drivers/usb/gadget/function/f_midi2.c) Use usb_ep->num_reqs instead of usb_ep->card->info.num_reqs in f_midi2_free_ep_reqs() and apply the same change for consistency in related request-freeing logic = Replace dereference of usb_ep->card->info.num_reqs with usb_ep->num_reqs
Event History
Frequently Asked Questions
Which systems are exposed to this crash condition?
Systems using the Linux MIDI 2.0 USB gadget configured through configfs with the block direction set to SNDRV_UMP_DIR_INPUT are affected by the described condition. In that configuration, the MIDI 1.0 OUT endpoint is intentionally not initialized.
What action triggers the failure?
A connected USB host must set the gadget's alternate setting. This causes the driver to stop both endpoints and attempt cleanup of the uninitialized OUT endpoint, resulting in a null-pointer dereference.
What can be done if the fix cannot be applied immediately?
Avoid configuring the MIDI 2.0 gadget block direction as SNDRV_UMP_DIR_INPUT. This prevents the described path in which the OUT endpoint is skipped during binding and later cleaned up unconditionally.