UBUNTU-CVE-2026-89735: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: remove default configfs groups on teardown fmidi2allocinst() creates default configfs child groups for the default endpoint and default block using configfsadddefaultgroup(), setting their internal refcount to 1. However, during function teardown in fmidi2freeinst() or EP cleanup in fmidi2epoptsrelease(), configfsremovedefaultgroups() is never called, therefore never dropping the refcount and leaking struct fmidi2epopts and fmidi2blockopts. Add the missing configfsremovedefaultgroups() in the afformentioned functions to free the structs properly.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Add calls to configfs_remove_default_groups() during teardown in f_midi2_free_inst() and during endpoint cleanup in f_midi2_ep_opts_release() so the default configfs groups are removed and the references to f_midi2_ep_opts and f_midi2_block_opts are released.
Event History
Frequently Asked Questions
Which Ubuntu kernel package variants are listed as affected?
The listed variants are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, ubuntu/linux-hwe-edge, and ubuntu/linux-gkeop.
Does the available information identify an attacker prerequisite or remote exploitation path?
No. The provided information describes a configfs reference-count leak during MIDI2 gadget teardown, but does not specify attacker access, a remote vector, or conditions required to trigger it.