CVE-2026-90024 (GCVE-0-2026-90024)
Vulnerability from cvelistv5 – Published: 2026-09-16 10:33 – Updated: 2026-10-19 08:56
VLAI
EPSS
VEX
Title
usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs
A null-pointer dereference occurs in f_midi2_free_ep_reqs() when attempting
to clean up an endpoint that was never initialized.
When configuring the MIDI 2.0 gadget via configfs and setting the block
direction to SNDRV_UMP_DIR_INPUT, the initialization of the midi1_ep_out
endpoint is explicitly skipped during the gadget bind phase
(f_midi2_bind()). As a result, the usb_ep->card field remains NULL.
Later, when the host sets the alternate setting, f_midi2_set_alt()
unconditionally stops both the IN and OUT endpoints by calling
f_midi2_stop_eps(), which in turn calls f_midi2_free_ep_reqs() for both
endpoints. When f_midi2_free_ep_reqs() is called for the uninitialized
midi1_ep_out, it attempts to dereference usb_ep->card to determine the
number of requests to free, leading to a crash.
Fix this by using usb_ep->num_reqs instead of usb_ep->card->info.num_reqs
in f_midi2_free_ep_reqs(). usb_ep->num_reqs is correctly set during
f_midi2_init_ep() and remains 0 if the endpoint was never initialized,
safely avoiding the loop. For consistency, apply the same change to
f_midi2_alloc_ep_reqs().
Oops: general protection fault, probably for non-canonical address
0xdffffc00000000ee: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000770-0x0000000000000777]
...
RIP: 0010:f_midi2_free_ep_reqs drivers/usb/gadget/function/f_midi2.c:1166
[inline]
RIP: 0010:f_midi2_stop_eps+0x28e/0x4d0
drivers/usb/gadget/function/f_midi2.c:1246
...
Call Trace:
<TASK>
f_midi2_set_alt+0x11c/0xf00 drivers/usb/gadget/function/f_midi2.c:1296
composite_setup+0x1ffd/0x3480 drivers/usb/gadget/composite.c:1933
configfs_composite_setup+0xbd/0x100 drivers/usb/gadget/configfs.c:1877
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
8b645922b22303cec4628dbbbf6c8553d1cdec87 , < 51ddc55c75087ac25342f6d73d3aeaf14f59bd76
(git)
Affected: 8b645922b22303cec4628dbbbf6c8553d1cdec87 , < 5b92f6a0c7c01efbb335d837ecdf34d38d98720f (git) Affected: 8b645922b22303cec4628dbbbf6c8553d1cdec87 , < 9c3d5091e3568ed48ac4c5b08a78eb06fad0d70a (git) Affected: 8b645922b22303cec4628dbbbf6c8553d1cdec87 , < 4079f19a0e1ce76f1e21a398f02aca150ceaaf61 (git) Affected: 8b645922b22303cec4628dbbbf6c8553d1cdec87 , < f0efaf1872949e96d213c8e910fd9517f7d7c406 (git) |
guessed | |
| Linux | Linux |
Affected:
6.6
Unaffected: 0 , < 6.6 (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_midi2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "51ddc55c75087ac25342f6d73d3aeaf14f59bd76",
"status": "affected",
"version": "8b645922b22303cec4628dbbbf6c8553d1cdec87",
"versionType": "git"
},
{
"lessThan": "5b92f6a0c7c01efbb335d837ecdf34d38d98720f",
"status": "affected",
"version": "8b645922b22303cec4628dbbbf6c8553d1cdec87",
"versionType": "git"
},
{
"lessThan": "9c3d5091e3568ed48ac4c5b08a78eb06fad0d70a",
"status": "affected",
"version": "8b645922b22303cec4628dbbbf6c8553d1cdec87",
"versionType": "git"
},
{
"lessThan": "4079f19a0e1ce76f1e21a398f02aca150ceaaf61",
"status": "affected",
"version": "8b645922b22303cec4628dbbbf6c8553d1cdec87",
"versionType": "git"
},
{
"lessThan": "f0efaf1872949e96d213c8e910fd9517f7d7c406",
"status": "affected",
"version": "8b645922b22303cec4628dbbbf6c8553d1cdec87",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_midi2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs\n\nA null-pointer dereference occurs in f_midi2_free_ep_reqs() when attempting\nto clean up an endpoint that was never initialized.\n\nWhen configuring the MIDI 2.0 gadget via configfs and setting the block\ndirection to SNDRV_UMP_DIR_INPUT, the initialization of the midi1_ep_out\nendpoint is explicitly skipped during the gadget bind phase\n(f_midi2_bind()). As a result, the usb_ep-\u003ecard field remains NULL.\n\nLater, when the host sets the alternate setting, f_midi2_set_alt()\nunconditionally stops both the IN and OUT endpoints by calling\nf_midi2_stop_eps(), which in turn calls f_midi2_free_ep_reqs() for both\nendpoints. When f_midi2_free_ep_reqs() is called for the uninitialized\nmidi1_ep_out, it attempts to dereference usb_ep-\u003ecard to determine the\nnumber of requests to free, leading to a crash.\n\nFix this by using usb_ep-\u003enum_reqs instead of usb_ep-\u003ecard-\u003einfo.num_reqs\nin f_midi2_free_ep_reqs(). usb_ep-\u003enum_reqs is correctly set during\nf_midi2_init_ep() and remains 0 if the endpoint was never initialized,\nsafely avoiding the loop. For consistency, apply the same change to\nf_midi2_alloc_ep_reqs().\n\nOops: general protection fault, probably for non-canonical address\n0xdffffc00000000ee: 0000 [#1] SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000770-0x0000000000000777]\n...\nRIP: 0010:f_midi2_free_ep_reqs drivers/usb/gadget/function/f_midi2.c:1166\n[inline]\nRIP: 0010:f_midi2_stop_eps+0x28e/0x4d0\ndrivers/usb/gadget/function/f_midi2.c:1246\n...\nCall Trace:\n \u003cTASK\u003e\n f_midi2_set_alt+0x11c/0xf00 drivers/usb/gadget/function/f_midi2.c:1296\n composite_setup+0x1ffd/0x3480 drivers/usb/gadget/composite.c:1933\n configfs_composite_setup+0xbd/0x100 drivers/usb/gadget/configfs.c:1877"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:56:38.894Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/51ddc55c75087ac25342f6d73d3aeaf14f59bd76"
},
{
"url": "https://git.kernel.org/stable/c/5b92f6a0c7c01efbb335d837ecdf34d38d98720f"
},
{
"url": "https://git.kernel.org/stable/c/9c3d5091e3568ed48ac4c5b08a78eb06fad0d70a"
},
{
"url": "https://git.kernel.org/stable/c/4079f19a0e1ce76f1e21a398f02aca150ceaaf61"
},
{
"url": "https://git.kernel.org/stable/c/f0efaf1872949e96d213c8e910fd9517f7d7c406"
}
],
"title": "usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90024",
"datePublished": "2026-09-16T10:33:27.624Z",
"dateReserved": "2026-09-11T19:38:34.782Z",
"dateUpdated": "2026-10-19T08:56:38.894Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-90024",
"date": "2026-11-10",
"epss": "0.002",
"percentile": "0.09908"
},
"microsoft_vex": {
"current_release_date": "2026-10-21T18:42:28.000Z",
"cve": "CVE-2026-90024",
"id": "msrc_CVE-2026-90024",
"initial_release_date": "2026-09-17T01:10:33.000Z",
"product_status:fixed": "1",
"product_status:known_affected": "2",
"product_status:under_investigation": "1",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-90024.json",
"version": "6"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_midi2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "51ddc55c75087ac25342f6d73d3aeaf14f59bd76",
"status": "affected",
"version": "8b645922b22303cec4628dbbbf6c8553d1cdec87",
"versionType": "git"
},
{
"lessThan": "5b92f6a0c7c01efbb335d837ecdf34d38d98720f",
"status": "affected",
"version": "8b645922b22303cec4628dbbbf6c8553d1cdec87",
"versionType": "git"
},
{
"lessThan": "9c3d5091e3568ed48ac4c5b08a78eb06fad0d70a",
"status": "affected",
"version": "8b645922b22303cec4628dbbbf6c8553d1cdec87",
"versionType": "git"
},
{
"lessThan": "4079f19a0e1ce76f1e21a398f02aca150ceaaf61",
"status": "affected",
"version": "8b645922b22303cec4628dbbbf6c8553d1cdec87",
"versionType": "git"
},
{
"lessThan": "f0efaf1872949e96d213c8e910fd9517f7d7c406",
"status": "affected",
"version": "8b645922b22303cec4628dbbbf6c8553d1cdec87",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_midi2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs\n\nA null-pointer dereference occurs in f_midi2_free_ep_reqs() when attempting\nto clean up an endpoint that was never initialized.\n\nWhen configuring the MIDI 2.0 gadget via configfs and setting the block\ndirection to SNDRV_UMP_DIR_INPUT, the initialization of the midi1_ep_out\nendpoint is explicitly skipped during the gadget bind phase\n(f_midi2_bind()). As a result, the usb_ep-\u003ecard field remains NULL.\n\nLater, when the host sets the alternate setting, f_midi2_set_alt()\nunconditionally stops both the IN and OUT endpoints by calling\nf_midi2_stop_eps(), which in turn calls f_midi2_free_ep_reqs() for both\nendpoints. When f_midi2_free_ep_reqs() is called for the uninitialized\nmidi1_ep_out, it attempts to dereference usb_ep-\u003ecard to determine the\nnumber of requests to free, leading to a crash.\n\nFix this by using usb_ep-\u003enum_reqs instead of usb_ep-\u003ecard-\u003einfo.num_reqs\nin f_midi2_free_ep_reqs(). usb_ep-\u003enum_reqs is correctly set during\nf_midi2_init_ep() and remains 0 if the endpoint was never initialized,\nsafely avoiding the loop. For consistency, apply the same change to\nf_midi2_alloc_ep_reqs().\n\nOops: general protection fault, probably for non-canonical address\n0xdffffc00000000ee: 0000 [#1] SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000770-0x0000000000000777]\n...\nRIP: 0010:f_midi2_free_ep_reqs drivers/usb/gadget/function/f_midi2.c:1166\n[inline]\nRIP: 0010:f_midi2_stop_eps+0x28e/0x4d0\ndrivers/usb/gadget/function/f_midi2.c:1246\n...\nCall Trace:\n \u003cTASK\u003e\n f_midi2_set_alt+0x11c/0xf00 drivers/usb/gadget/function/f_midi2.c:1296\n composite_setup+0x1ffd/0x3480 drivers/usb/gadget/composite.c:1933\n configfs_composite_setup+0xbd/0x100 drivers/usb/gadget/configfs.c:1877"
}
],
"id": "CVE-2026-90024",
"lastModified": "2026-10-19T09:18:50.473",
"metrics": {},
"published": "2026-09-16T11:17:15.357",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/4079f19a0e1ce76f1e21a398f02aca150ceaaf61"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/51ddc55c75087ac25342f6d73d3aeaf14f59bd76"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/5b92f6a0c7c01efbb335d837ecdf34d38d98720f"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/9c3d5091e3568ed48ac4c5b08a78eb06fad0d70a"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/f0efaf1872949e96d213c8e910fd9517f7d7c406"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-11-06T01:28:15+00:00",
"cve": "CVE-2026-90024",
"id": "CVE-2026-90024",
"initial_release_date": "2026-09-16T00:00:00+00:00",
"product_status:known_not_affected": "203",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90024.json",
"version": "3"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.