CVE-2026-90024: Linux Kernel USB MIDI2 Use-After-Free

CVE-2026-90024 Overview

CVE-2026-90024 is a null pointer dereference vulnerability in the Linux kernel's USB gadget MIDI 2.0 function driver (f_midi2). The flaw resides in f_midi2_free_ep_reqs() within drivers/usb/gadget/function/f_midi2.c. When a MIDI 2.0 gadget is configured through configfs with the block direction set to SNDRV_UMP_DIR_INPUT, the driver skips initialization of the midi1_ep_out endpoint during the bind phase. A subsequent host SET_INTERFACE request triggers f_midi2_set_alt(), which unconditionally stops both endpoints and dereferences usb_ep->card on the uninitialized endpoint. The result is a kernel general protection fault [CWE-476].

Critical Impact
Local attackers with access to the USB gadget configfs interface can trigger a kernel crash, resulting in denial of service on affected Linux systems.

Affected Products

Linux kernel versions containing the f_midi2 USB gadget function driver
Systems using MIDI 2.0 USB gadget configuration via configfs
Distributions shipping vulnerable stable kernel branches prior to the referenced fix commits

Discovery Timeline

2026-09-16 - CVE-2026-90024 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90024

Vulnerability Analysis

The vulnerability lives in the Linux kernel USB gadget subsystem, specifically the MIDI 2.0 function driver at drivers/usb/gadget/function/f_midi2.c. When a gadget administrator configures a MIDI block with direction SNDRV_UMP_DIR_INPUT, the bind routine f_midi2_bind() skips initialization of the midi1_ep_out endpoint. The usb_ep->card field for that endpoint remains NULL.

Later, when the USB host issues a SET_INTERFACE control request, the driver invokes f_midi2_set_alt() at line 1296. That handler calls f_midi2_stop_eps(), which in turn calls f_midi2_free_ep_reqs() for both IN and OUT endpoints without checking initialization state. The free routine reads usb_ep->card->info.num_reqs to determine loop bounds, dereferencing the NULL card pointer and causing a general protection fault detected by KASAN.

Root Cause

The root cause is an assumption that both IN and OUT endpoints are always initialized during bind. The cleanup path uses the uninitialized usb_ep->card structure member to compute the request count. The upstream fix replaces usb_ep->card->info.num_reqs with usb_ep->num_reqs, a field that is zero-initialized and only set during f_midi2_init_ep(). When the endpoint was never initialized, the loop iterates zero times and safely returns.

Attack Vector

Exploitation requires local access to the USB gadget configfs interface, typically restricted to privileged users. An attacker configures a MIDI 2.0 gadget with a block direction of SNDRV_UMP_DIR_INPUT, then triggers a host-side SET_INTERFACE request. On systems where the gadget is bound to a USB device controller, connecting to a host is sufficient to trigger the crash. The impact is a kernel oops and denial of service.

The issue is a kernel-side NULL pointer dereference triggered along the f_midi2_set_alt → f_midi2_stop_eps → f_midi2_free_ep_reqs code path. Refer to the upstream commits linked below for the exact source-level fix.

Detection Methods for CVE-2026-90024

Indicators of Compromise

Kernel oops messages referencing f_midi2_free_ep_reqs or f_midi2_stop_eps in dmesg or /var/log/kern.log
KASAN reports flagging null-ptr-deref within drivers/usb/gadget/function/f_midi2.c
Unexpected system reboots or crashes on hosts using USB gadget MIDI 2.0 configurations

Detection Strategies

Inventory Linux systems running kernels that include the f_midi2 driver and identify those exposing USB gadget configfs to non-root users or containers
Audit configfs configurations under /sys/kernel/config/usb_gadget/ for MIDI 2.0 function instances with input-only block directions
Monitor kernel logs for general protection fault entries referencing the f_midi2 call chain

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on general protection fault events involving USB gadget symbols
Track kernel package versions across the fleet and flag hosts running pre-fix stable branches
Watch for creation or modification of USB gadget configfs objects on production systems where gadget mode is not required

How to Mitigate CVE-2026-90024

Immediate Actions Required

Apply the upstream stable kernel patches referenced in the kernel.org commits below
Restrict access to /sys/kernel/config/usb_gadget/ to root-only where gadget functionality is required
Disable the CONFIG_USB_F_MIDI2 kernel module on systems that do not require MIDI 2.0 gadget support

Patch Information

The fix replaces the dereference of usb_ep->card->info.num_reqs with usb_ep->num_reqs in both f_midi2_free_ep_reqs() and f_midi2_alloc_ep_reqs(). Patches are available in the following stable kernel commits: Kernel Commit 4079f19, Kernel Commit 51ddc55, Kernel Commit 5b92f6a, Kernel Commit 9c3d509, and Kernel Commit f0efaf1.

Workarounds

Unload the f_midi2 module with modprobe -r f_midi2 on systems that do not use MIDI 2.0 gadget functionality
Blacklist the module through /etc/modprobe.d/ to prevent auto-load
Avoid configuring MIDI 2.0 gadget blocks with SNDRV_UMP_DIR_INPUT direction until the patched kernel is deployed
Restrict USB device controller access in containerized workloads to prevent unprivileged gadget configuration

bash

# Prevent the vulnerable module from loading
echo "blacklist f_midi2" | sudo tee /etc/modprobe.d/disable-f_midi2.conf
sudo modprobe -r f_midi2 2>/dev/null || true

# Verify the module is not loaded
lsmod | grep f_midi2