UBUNTU-CVE-2026-90024: Medium severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix null-pointer dereference in fmidi2freeepreqs A null-pointer dereference occurs in fmidi2freeepreqs() when attempting to clean up an endpoint that was never initialized. When configuring the MIDI 2.0 gadget via configfs and setting the block direction to SNDRVUMPDIRINPUT, the initialization of the midi1epout endpoint is explicitly skipped during the gadget bind phase (fmidi2bind()). As a result, the usbep->card field remains NULL. Later, when the host sets the alternate setting, fmidi2setalt() unconditionally stops both the IN and OUT endpoints by calling fmidi2stopeps(), which in turn calls fmidi2freeepreqs() for both endpoints. When fmidi2freeepreqs() is called for the uninitialized midi1epout, it attempts to dereference usbep->card to determine the number of requests to free, leading to a crash. Fix this by using usbep->numreqs instead of usbep->card->info.numreqs in fmidi2freeepreqs(). usbep->numreqs is correctly set during fmidi2initep() and remains 0 if the endpoint was never initialized, safely avoiding the loop. For consistency, apply the same change to fmidi2allocepreqs(). Oops: general protection fault, probably for non-canonical address 0xdffffc00000000ee: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000770-0x0000000000000777] ... RIP: 0010:fmidi2freeepreqs drivers/usb/gadget/function/fmidi2.c:1166 [inline] RIP: 0010:fmidi2stopeps+0x28e/0x4d0 drivers/usb/gadget/function/fmidi2.c:1246 ... Call Trace: <TASK> fmidi2setalt+0x11c/0xf00 drivers/usb/gadget/function/fmidi2.c:1296 compositesetup+0x1ffd/0x3480 drivers/usb/gadget/composite.c:1933 configfscompositesetup+0xbd/0x100 drivers/usb/gadget/configfs.c:1877