CVE-2026-89735 Overview
CVE-2026-89735 is a memory leak vulnerability in the Linux kernel's USB gadget MIDI2 function driver. The flaw resides in f_midi2_alloc_inst(), which creates default configfs child groups for the default endpoint and default block using configfs_add_default_group(). This call sets the internal refcount to 1, but teardown paths never drop that reference.
During function teardown in f_midi2_free_inst() or endpoint cleanup in f_midi2_ep_opts_release(), the kernel does not call configfs_remove_default_groups(). As a result, struct f_midi2_ep_opts and struct f_midi2_block_opts are leaked on every teardown cycle.
Critical Impact
Repeated allocation and teardown of USB gadget MIDI2 instances leaks kernel memory, contributing to resource exhaustion on long-running systems that use the MIDI2 gadget function.
Affected Products
- Linux kernel versions containing the USB gadget MIDI2 (f_midi2) function driver
- Stable branches referenced by the upstream fix commits
- Downstream distributions that ship the affected f_midi2 driver
Discovery Timeline
- 2026-09-11 - CVE-2026-89735 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-89735
Vulnerability Analysis
The Linux kernel's USB gadget MIDI2 function exposes configuration through the configfs filesystem. When a gadget function instance is allocated, f_midi2_alloc_inst() registers default child groups representing the default endpoint and default block. Each configfs_add_default_group() call takes a reference on the associated config_group.
The teardown paths, f_midi2_free_inst() and f_midi2_ep_opts_release(), free the parent structures without invoking configfs_remove_default_groups(). Because the default group references are never released, the backing struct f_midi2_ep_opts and struct f_midi2_block_opts allocations remain pinned in kernel memory. This produces a deterministic memory leak on every create-and-destroy cycle of a MIDI2 gadget instance.
Root Cause
The root cause is a missing cleanup call for configfs default groups during instance teardown. configfs_add_default_group() and configfs_remove_default_groups() are paired APIs, and the MIDI2 driver invoked only the former. The fix adds the missing configfs_remove_default_groups() calls in both teardown functions so the group refcounts drop to zero and the option structures are released.
Attack Vector
Exploitation requires local privileges sufficient to create and destroy USB gadget configurations via configfs, typically root or a process with CAP_SYS_ADMIN. A local actor who repeatedly instantiates and tears down MIDI2 gadget functions can gradually consume kernel memory. The issue does not provide direct code execution but can contribute to denial-of-service conditions on systems that programmatically manage USB gadget configurations.
The vulnerability is a kernel memory leak; no proof-of-concept exploitation code has been published. Technical details for the fix are available in the upstream stable commits: 0f6bffb5008f, 4beda67ee72e, 79dbedf40ad9, 9ea5dfb2bfef, and a15c2acd3083.
Detection Methods for CVE-2026-89735
Indicators of Compromise
- Steadily growing kernel slab usage tied to configfs allocations without a corresponding workload increase
- Repeated mount, configuration, and teardown of USB gadget MIDI2 functions in system logs or audit trails
- kmemleak reports pointing to f_midi2_alloc_inst or configfs group allocations
Detection Strategies
- Enable CONFIG_DEBUG_KMEMLEAK on test systems and scan /sys/kernel/debug/kmemleak for unreferenced allocations tied to f_midi2_ep_opts or f_midi2_block_opts.
- Audit configfs activity under /sys/kernel/config/usb_gadget/*/functions/midi2.* for repeated create and remove cycles.
- Compare running kernel version against the fixed stable commits and flag hosts still on vulnerable builds.
Monitoring Recommendations
- Track /proc/meminfoSlab and SReclaimable trends on systems that use the USB gadget subsystem.
- Alert on unexpected long-term growth of kernel memory on embedded or gadget-enabled hosts.
- Log privileged writes to /sys/kernel/config/usb_gadget/ to correlate configuration changes with memory growth.
How to Mitigate CVE-2026-89735
Immediate Actions Required
- Update to a Linux kernel build that includes the referenced stable commits adding configfs_remove_default_groups() in f_midi2_free_inst() and f_midi2_ep_opts_release().
- Restrict configfs and USB gadget administration to trusted operators only.
- Reboot long-running gadget hosts after patching to reclaim previously leaked memory.
Patch Information
The upstream fix adds the missing configfs_remove_default_groups() calls in the MIDI2 teardown paths so the default endpoint and block groups drop their references, allowing the f_midi2_ep_opts and f_midi2_block_opts structures to be freed. Backports are available in the stable kernel commits 0f6bffb5008f, 4beda67ee72e, 79dbedf40ad9, 9ea5dfb2bfef, and a15c2acd3083. Apply the vendor kernel update for your distribution as soon as it is available.
Workarounds
- Disable or unload the f_midi2 module on systems that do not require USB MIDI 2.0 gadget support.
- Avoid automated scripts that repeatedly create and destroy MIDI2 gadget instances until the patch is deployed.
- Restrict access to /sys/kernel/config/usb_gadget/ using filesystem permissions and mandatory access controls.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
