CVE-2026-90021: Linux Kernel USB Gadget Use-After-Free

CVE-2026-90021 Overview

CVE-2026-90021 is a Linux kernel vulnerability in the USB gadget MIDI function driver (f_midi). The flaw stems from an uninitialized work_struct used when the gadget is freed without ever being bound. When f_midi_bind() is not called, the INIT_WORK macro never executes, leaving work->func set to zero. A subsequent call to f_midi_free() triggers __flush_work, which emits a kernel warning because the work item was never initialized.

Critical Impact
The defect produces kernel warnings and can lead to unstable behavior in the USB gadget subsystem when the MIDI function is allocated but never bound.

Affected Products

Linux kernel USB gadget subsystem (drivers/usb/gadget/function/f_midi.c)
Stable kernel branches referenced in commits 02ac76f, 3d8b112, 7e07d3e, and 858576d
Systems configured as USB MIDI gadgets

Discovery Timeline

2026-09-16 - CVE-2026-90021 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90021

Vulnerability Analysis

The f_midi function driver implements USB MIDI gadget functionality in the Linux kernel. During allocation, f_midi_alloc() sets free_ref to 1. The reference count only increments when f_midi_register_card() registers a sound card, which occurs exclusively inside f_midi_bind(). The bind path is also the sole location where INIT_WORK initializes the deferred work structure.

When the gadget is allocated but the bind operation never runs, the work structure remains in an uninitialized state. On teardown, f_midi_free() evaluates a conditional that becomes true under this scenario and invokes __flush_work on the uninitialized work item. The kernel then triggers a warning because work->func equals zero, indicating an invalid callback pointer.

Root Cause

The root cause is improper initialization ordering. The INIT_WORK call was placed in f_midi_bind() instead of f_midi_alloc(), creating a code path where allocation and teardown occur without the work structure ever being initialized. The upstream fix relocates INIT_WORK into f_midi_alloc() so the work structure is always initialized once the function instance exists.

Attack Vector

Triggering the condition requires a local configuration in which a USB MIDI gadget function is allocated through the configfs interface but the bind step never completes. This scenario typically arises during gadget composition errors, teardown races, or specific configfs manipulation sequences. The primary impact is a kernel warning and potential instability in the USB gadget subsystem rather than direct code execution.

See the patch commits for technical details: Kernel Git Commit 02ac76f, Kernel Git Commit 3d8b112, Kernel Git Commit 7e07d3e, and Kernel Git Commit 858576d.

Detection Methods for CVE-2026-90021

Indicators of Compromise

Kernel warnings referencing __flush_work with a null work->func pointer originating from f_midi_free
Stack traces in dmesg involving f_midi.c teardown paths
Repeated USB gadget composition failures followed by warning splats on function release

Detection Strategies

Parse dmesg and journalctl -k output for WARNING entries tied to __flush_work and the f_midi module
Correlate USB gadget configfs operations with subsequent kernel warnings to identify vulnerable code paths
Inventory running kernels against the fixed stable commits listed above to identify unpatched hosts

Monitoring Recommendations

Forward kernel logs to a central log store and alert on WARNING entries referencing f_midi or flush_work
Monitor USB gadget composition activity on embedded and developer systems where MIDI gadgets are configured
Track kernel package versions across the fleet to confirm rollout of the fix

How to Mitigate CVE-2026-90021

Immediate Actions Required

Apply the stable kernel updates containing commits 02ac76f, 3d8b112, 7e07d3e, or 858576d, whichever matches your maintained kernel branch
Reboot affected systems after upgrading the kernel package to ensure the patched module loads
Audit systems that expose USB gadget configfs to non-privileged workloads and restrict access

Patch Information

The upstream fix moves INIT_WORK from f_midi_bind() into f_midi_alloc(), guaranteeing that the work structure is initialized as soon as the function instance is allocated. Distribution kernels should pick up the change from the referenced stable commits. Confirm the fix landed by inspecting drivers/usb/gadget/function/f_midi.c for the relocated INIT_WORK call.

Workarounds

Unload the usb_f_midi module on systems that do not require USB MIDI gadget functionality
Avoid configfs sequences that allocate the MIDI function without completing the bind operation
Restrict access to /sys/kernel/config/usb_gadget/ to trusted administrators only

bash

# Disable the USB MIDI gadget module if not required
sudo modprobe -r usb_f_midi
echo 'blacklist usb_f_midi' | sudo tee /etc/modprobe.d/blacklist-usb-f-midi.conf