CVE-2026-90022 Overview
CVE-2026-90022 is a use-after-free vulnerability in the Linux kernel's USB gadget subsystem, specifically in the f_midi2 function driver. The flaw resides in the f_midi2_opts_str_show() string attribute show path. Callers dereference the opts->info.<field> pointer before acquiring the string lock, creating a race with f_midi2_opts_str_store() which frees the old string under opts->lock when the attribute is written concurrently. A local attacker with the ability to read and write ConfigFS attributes can trigger memory corruption in kernel space, leading to potential privilege escalation or denial of service.
Critical Impact
A local, low-privileged attacker can exploit a race condition in the USB gadget MIDI 2.0 configfs interface to achieve kernel memory corruption, threatening confidentiality, integrity, and availability of the affected system.
Affected Products
- Linux kernel versions containing the usb: gadget: f_midi2 driver
- Distributions shipping vulnerable stable kernel branches prior to the referenced fix commits
- Systems with USB gadget ConfigFS interface exposed to unprivileged workflows
Discovery Timeline
- 2026-09-16 - CVE-2026-90022 published to the National Vulnerability Database
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-90022
Vulnerability Analysis
The vulnerability is a use-after-free [CWE-416] triggered by a race condition [CWE-362] in the USB gadget MIDI 2.0 function driver. The Linux kernel exposes gadget configuration through ConfigFS, allowing userspace to read and write string attributes such as iface_name and block name fields on f_midi2. The show helper f_midi2_opts_str_show() was designed to take the string lock internally to serialize access. However, its callers passed the string by value after dereferencing opts->info.<field> outside the protection of that lock.
When a second thread invokes f_midi2_opts_str_store() on the same attribute, the store path frees the previously allocated string buffer under opts->lock and replaces it with a new allocation. If the show path already dereferenced the pointer but has not yet entered the lock, it holds a dangling reference to freed memory. The subsequent read inside str_show() operates on freed heap contents, producing an exploitable use-after-free window.
Root Cause
The root cause is inconsistent lock discipline between the show and store code paths for ConfigFS string attributes in f_midi2. The store path correctly frees and replaces the string under opts->lock, while the show callers dereferenced the pointer before locking. This mismatch violates the invariant that any access to opts->info.<field> must occur while opts->lock is held.
Attack Vector
Exploitation requires local access with permissions to interact with the USB gadget ConfigFS hierarchy, typically /sys/kernel/config/usb_gadget/. An attacker races concurrent read and write operations on the same MIDI 2.0 string attribute to trigger the use-after-free. Successful exploitation can corrupt kernel heap objects reallocated in the freed slot, enabling privilege escalation or kernel panic depending on the heap grooming performed.
No public proof-of-concept code has been published. Technical details of the fix are available in the upstream commits, including Kernel Git Commit 49fab5e and Kernel Git Commit fed0aa7c.
Detection Methods for CVE-2026-90022
Indicators of Compromise
- Kernel oops or panic logs referencing f_midi2_opts_str_show or configfs_read_iter in the call stack
- KASAN (Kernel Address Sanitizer) reports flagging use-after-free in the drivers/usb/gadget/function/f_midi2.c module
- Unexpected reads of freed slab objects during concurrent ConfigFS attribute access on USB gadget interfaces
Detection Strategies
- Enable KASAN on test and staging kernels to surface use-after-free access in the f_midi2 code paths
- Audit running kernel versions against the fix commits referenced in the upstream stable tree
- Monitor dmesg output on production hosts for slab corruption warnings correlated with USB gadget activity
Monitoring Recommendations
- Track processes writing to /sys/kernel/config/usb_gadget/*/functions/midi2.*/ attributes concurrently with reads
- Alert on unexpected kernel crashes on systems that expose USB gadget ConfigFS to non-root users or containers
- Collect and centralize kernel logs to identify race-related panics across the fleet
How to Mitigate CVE-2026-90022
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the stable tree commits to eliminate the race condition
- Restrict access to USB gadget ConfigFS mount points to root-only until patched kernels are deployed
- Prioritize patching on embedded devices, developer workstations, and any system exposing gadget interfaces to unprivileged users
Patch Information
The fix changes f_midi2_opts_str_show() to accept a pointer to the string field, matching the pattern already used in f_midi2_opts_str_store(). The pointer is dereferenced only after opts->lock is acquired. All three callers, iface_name, block name, and the EP string option macro, were updated accordingly. Fixes are available in the following upstream commits: Kernel Git Commit 49fab5e, Kernel Git Commit d11f3300, Kernel Git Commit e89e30f0, Kernel Git Commit f9bdf4c4, and Kernel Git Commit fed0aa7c.
Workarounds
- Unload the f_midi2 kernel module on systems that do not require USB MIDI 2.0 gadget functionality
- Unmount or restrict permissions on the ConfigFS gadget hierarchy to prevent concurrent attribute access by unprivileged users
- Disable the CONFIG_USB_F_MIDI2 kernel option in custom kernel builds where the feature is unused
# Configuration example: unload the vulnerable module and restrict configfs access
sudo modprobe -r usb_f_midi2
sudo chmod 700 /sys/kernel/config/usb_gadget
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
