CVE-2026-64584: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64584 Overview

CVE-2026-64584 is a use-after-free vulnerability in the Linux kernel's USB gadget MIDI function driver (f_midi). The flaw resides in the driver's work-item lifecycle management, where midi->work can remain pending after the enclosing struct f_midi has been freed. A concurrent userspace write on an open ALSA rawmidi substream can rearm the work item after f_midi_disable() returns, causing f_midi_in_work() to dereference freed memory through container_of(). The issue was identified through in-house static analysis and resolved by calling cancel_work_sync(&midi->work) in the refcount-zero block of f_midi_free().

Critical Impact
A local attacker with access to an open rawmidi substream can trigger a use-after-free in the Linux kernel, potentially leading to kernel memory corruption or privilege escalation.

Affected Products

Linux kernel with USB gadget f_midi driver enabled
Systems exposing ALSA rawmidi substreams through USB gadget MIDI
Distributions shipping the vulnerable drivers/usb/gadget/function/f_midi.c code

Discovery Timeline

2026-08-06 - CVE-2026-64584 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-64584

Vulnerability Analysis

The f_midi driver embeds a work_struct (midi->work) whose handler f_midi_in_work() accesses the enclosing struct f_midi via container_of(). The work is armed from two locations: f_midi_complete() on IN-endpoint completion and f_midi_in_trigger() on ALSA rawmidi output-stream start. Neither f_midi_disable() nor f_midi_unbind() cancels the pending work. The midi object uses reference counting through midi->free_ref and is only freed in f_midi_free() after both the usb_function reference and the rawmidi private_data reference are dropped.

Root Cause

The root cause is a lifecycle mismatch between the work item and the object it references [CWE-416, Use After Free]. During f_midi_unbind(), f_midi_disable() runs before the sound card is released. The USB endpoints are disabled, but the rawmidi device remains accessible to any userspace process holding an open substream. Cancelling the work only in f_midi_disable() is insufficient because the ALSA trigger path can rearm it after disable returns.

Attack Vector

A local user with permission to open the rawmidi character device can issue a write to a substream. This reaches f_midi_in_trigger(), which queues midi->work even after the underlying USB endpoints have been torn down. When the final reference to the midi object drops, f_midi_free() calls kfree(midi) while the work is still pending. The pending handler then dereferences freed kernel memory, producing a use-after-free primitive that can be leveraged for kernel memory corruption.

No verified proof-of-concept code is publicly available. Refer to the upstream commits linked under Patch Information for the exact code paths.

Detection Methods for CVE-2026-64584

Indicators of Compromise

Kernel oops or panic messages referencing f_midi_in_work, f_midi_transmit, or container_of on freed slab objects
KASAN reports flagging use-after-free reads in drivers/usb/gadget/function/f_midi.c
Unexpected crashes during USB gadget teardown while a userspace process holds /dev/snd/midiC*D* open

Detection Strategies

Enable KASAN (CONFIG_KASAN) on test kernels to surface the use-after-free at the point of dereference
Audit running kernels for the presence of the fixed commits listed in the Linux stable tree
Monitor dmesg and crash reporting infrastructure for oops signatures involving f_midi symbols

Monitoring Recommendations

Track processes opening ALSA rawmidi devices on systems configured with USB gadget MIDI
Alert on kernel crashes correlated with USB gadget configfs teardown operations
Collect and retain kernel core dumps for post-incident analysis of f_midi faults

How to Mitigate CVE-2026-64584

Immediate Actions Required

Apply the upstream Linux kernel patches that add cancel_work_sync(&midi->work) inside the refcount-zero block of f_midi_free()
Rebuild and deploy kernels from a stable branch containing the fix on all systems using USB gadget MIDI
Restrict access to ALSA rawmidi device nodes to trusted users where possible

Patch Information

The upstream fix cancels the pending work synchronously at the refcount-zero free site, ensuring neither arming source can survive. Fixed commits are available in the Linux stable tree:

Workarounds

Disable the USB gadget MIDI function (CONFIG_USB_F_MIDI) in the kernel configuration if the functionality is not required
Unload the usb_f_midi module on systems where it is not actively used
Tighten permissions on /dev/snd/midiC*D* device nodes to limit which users can trigger the ALSA rawmidi path

bash

# Remove the f_midi module and restrict rawmidi device access
sudo modprobe -r usb_f_midi
sudo chmod 660 /dev/snd/midiC*D*
sudo chown root:audio /dev/snd/midiC*D*