UBUNTU-CVE-2026-90021: Low severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi: initialize work in fmidialloc() fmidialloc initializes freeref to 1 and it can only be incremented when a sound card is registered via fmidiregistercard(). fmidiregistercard() is only called in fmidibind() which actually performs INITWORK. If fmidibind() is never run, work is not initialized and the if condition in fmidifree becomes true, this results in a warning later in flushwork as work->func = 0. Fix this by moving INITWORK from fmidibind() to fmidialloc().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Move INIT_WORK from f_midi_bind() to f_midi_alloc() so work is initialized even when f_midi_bind() is never run.
Linux kernel USB gadget f_midi INIT_WORK initialization location = f_midi_alloc()
Event History
Frequently Asked Questions
What condition triggers the warning?
The warning occurs when an f_midi instance is freed without f_midi_bind() having run. In that path, the work item has not been initialized, and f_midi_free() can later flush work whose function pointer is zero.
What component or configuration path is implicated?
The issue is in the Linux USB gadget MIDI function (f_midi). It is associated with cases where the MIDI gadget function is allocated but never bound; the provided data does not establish whether this is reachable in a default configuration.
Which Ubuntu kernel packages are listed as affected?
The listed packages are ubuntu/linux, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-azure-fde, ubuntu/linux-gcp, ubuntu/linux-gke, ubuntu/linux-ibm, and ubuntu/linux-realtime.