UBUNTU-CVE-2026-90022: Use After Free
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi2: fix use-after-free in string attribute show path fmidi2optsstrshow() takes the string lock internally, but its callers dereference the opts->info.<field> pointer before calling it, outside the lock. This races with fmidi2optsstrstore(), which frees the old string under opts->lock when the attribute is written concurrently, the show path can read a pointer that gets freed before the lock inside strshow() is even taken. Change fmidi2optsstrshow() to take a pointer to the string field, matching the existing pattern in fmidi2optsstrstore(), and dereference it only after the lock is held. Update all three callers (ifacename, block name, and the EP string option macro) accordingly.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What level of access is required to exploit this issue?
The vulnerability has a local attack vector and requires low privileges. Exploitation requires racing reads of affected f_midi2 string attributes with concurrent writes that replace and free those strings.
Which systems are potentially exposed?
Ubuntu systems running the listed Linux kernel packages are potentially affected when the f_midi2 USB gadget functionality is in use and its relevant string attributes can be read and modified concurrently. The affected attributes include iface_name, block name, and endpoint string options.