CVE-2026-64584 Linux CVE debrief

Who should care

Linux kernel developers, Linux distribution maintainers, and users of Linux-based systems should review and apply the patch to prevent potential exploitation of this vulnerability. Additionally, security teams and vulnerability management teams should assess the impact of this vulnerability on their systems and prioritize patching accordingly. Affected operators should review the Linux kernel source code, specifically the f_midi driver implementation, and assess the patch provided to cancel the pending work item before freeing the midi object.

Technical summary

The f_midi driver in the Linux kernel fails to cancel a pending work item before freeing the midi object, leading to a use-after-free vulnerability. An attacker may potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition. The vulnerability occurs when the f_midi driver fails to synchronize the work item, and the sound card is released asynchronously to the final free of the midi object. The f_midi driver embeds a work item whose handler dereferences the enclosing struct f_midi through container_of(). The work is armed from two sites: f_midi_complete() and f_midi_in_trigger(). To verify, defenders should review the Linux kernel source code, specifically the f_midi driver implementation, and assess the patch provided to cancel the pending work item before freeing the midi object.

Defensive priority

High

Recommended defensive actions

• Apply the patch to cancel the pending work item before freeing the midi object
• Review and update the f_midi driver's synchronization mechanisms
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was found by an in-house static analysis tool. The f_midi driver embeds a work item whose handler dereferences the enclosing struct f_midi through container_of(). The work is armed from two sites: f_midi_complete() and f_midi_in_trigger(). To verify, defenders should review the Linux kernel source code, specifically the f_midi driver implementation, and assess the patch provided to cancel the pending work item before freeing the midi object.

Official resources