CVE-2026-74642: Linux Kernel ALSA USB Use-After-Free Flaw

CVE-2026-74642 Overview

CVE-2026-74642 is a use-after-free (UAF) vulnerability in the Linux kernel's Advanced Linux Sound Architecture (ALSA) USB MIDI 2.0 subsystem. The flaw resides in the delayed release path for Universal MIDI Packet (UMP) endpoints. A prior fix for a UAF in ump_to_endpoint() introduced a regression: the code attempts to dereference the UMP endpoint object in a delayed context after the endpoint has already been released.

The upstream fix adds a private_free handler that clears associated data, preventing subsequent dereferences during delayed release of MIDI2 endpoints [CWE-416].

Critical Impact
Local exploitation of the use-after-free condition could lead to kernel memory corruption, denial of service, or potential privilege escalation on systems using USB MIDI 2.0 devices.

Affected Products

Linux Kernel — ALSA USB MIDI2 subsystem (sound/usb/midi2.c)
Distributions shipping kernels containing the earlier ump_to_endpoint() UAF fix
Stable kernel trees referenced by the upstream commits 422d8a0, d217d72, d431941, f8a80cf, and f9d492a

Discovery Timeline

2026-08-22 - CVE-2026-74642 published to the National Vulnerability Database (NVD)
2026-08-22 - Last updated in NVD database

Technical Details for CVE-2026-74642

Vulnerability Analysis

The vulnerability lives in the ALSA USB MIDI 2.0 driver code responsible for tearing down UMP endpoints. UMP endpoints represent logical MIDI 2.0 streams associated with a USB audio device. When a device is disconnected or the driver is unloaded, endpoint release can occur through a delayed callback path.

A previous commit hardened ump_to_endpoint() against an earlier UAF, but the corrected code still dereferences the endpoint object during delayed release. If the endpoint has already been freed by the time the delayed callback executes, the dereference reads or writes freed memory. This is a classic order-of-operations bug in the object lifecycle, where the callback context outlives the object it references.

The upstream patch adds a private_free function that clears the associated data pointer at the correct point in the teardown sequence. This ensures that any deferred code path cannot dereference stale endpoint state after release.

Root Cause

The root cause is improper object lifetime management between the synchronous endpoint release path and delayed release callbacks in the MIDI2 driver. The prior UAF fix in ump_to_endpoint() did not account for delayed contexts where the endpoint object may have already been freed.

Attack Vector

Exploitation generally requires local access with the ability to interact with USB MIDI 2.0 device attach and detach events, or to trigger the driver's release path. An attacker capable of connecting a crafted USB MIDI 2.0 device, or racing a device disconnect with in-flight ioctl operations, could induce the delayed release path and dereference freed memory. See the upstream kernel commits linked in Linux Kernel Commit #422d8a0 and Linux Kernel Commit #f9d492a for the affected code paths.

The vulnerability manifests in the endpoint release logic. See the security advisory and referenced commits for technical details.

Detection Methods for CVE-2026-74642

Indicators of Compromise

Kernel oops or panic messages referencing snd-usb-audio, snd_ump, or MIDI2 endpoint teardown paths in dmesg or the system journal.
KASAN (Kernel Address Sanitizer) reports flagging use-after-free access in ALSA USB MIDI2 endpoint release functions.
Unexpected system instability or crashes correlated with USB MIDI 2.0 device attach or detach events.

Detection Strategies

Compare the running kernel version and vendor patch level against the fixed commits referenced in the NVD advisory to identify unpatched hosts.
Enable KASAN in test environments to catch UAF conditions during USB MIDI device fuzzing.
Monitor endpoint telemetry for repeated USB device enumeration events involving MIDI 2.0 class devices from untrusted peripherals.

Monitoring Recommendations

Ingest kernel logs into a centralized platform and alert on BUG:, KASAN:, or general protection fault entries citing ALSA or UMP symbols.
Track USB device connection events on servers and workstations that should not have MIDI hardware attached.
Correlate kernel crash dumps with recent USB peripheral activity to identify potential exploitation attempts.

How to Mitigate CVE-2026-74642

Immediate Actions Required

Upgrade to a Linux kernel version containing the upstream fix commits (422d8a0, d217d72, d431941, f8a80cf, f9d492a) or the vendor-backported equivalent.
Inventory hosts running kernels that include the earlier ump_to_endpoint() UAF fix but lack the follow-up delayed-release fix.
Prioritize patching of multi-user systems, shared workstations, and hosts where untrusted USB devices may be connected.

Patch Information

The fix has been merged upstream and backported to stable branches. Refer to Linux Kernel Commit #d217d72, Linux Kernel Commit #d431941, Linux Kernel Commit #f8a80cf, Linux Kernel Commit #422d8a0, and Linux Kernel Commit #f9d492a for the authoritative source changes. Apply distribution-provided kernel updates once available.

Workarounds

Blacklist the snd_usb_audio and snd_ump modules on systems that do not require USB MIDI 2.0 functionality.
Restrict physical and logical access to USB ports using USBGuard or similar allowlisting tools to block unknown MIDI class devices.
Disable loading of ALSA USB MIDI modules on servers and infrastructure hosts where audio hardware is unnecessary.

bash

# Blacklist ALSA USB MIDI modules until the kernel is patched
echo 'blacklist snd_ump' | sudo tee /etc/modprobe.d/blacklist-snd-ump.conf
echo 'blacklist snd_usb_audio' | sudo tee -a /etc/modprobe.d/blacklist-snd-ump.conf
sudo update-initramfs -u

# Verify current kernel version against fixed commits
uname -r