CVE-2026-90021 Linux CVE debrief

Who should care

Linux kernel developers and administrators who use the usb gadget: f_midi component should review and apply the patch to prevent potential warnings in __flush_work. They should also verify the Linux kernel version and apply the patch if necessary. Additionally, they should monitor the system for potential warnings in __flush_work and review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

Linux kernel vulnerability in usb gadget: f_midi component can lead to warnings in __flush_work. Review and apply patch to prevent potential issues.

• Verify patch deployment to prevent warnings in __flush_work
• Review Linux kernel version and apply patch if necessary
• Monitor system for potential warnings in __flush_work

Technical summary

The vulnerability occurs because the work is not initialized in the f_midi_alloc function, which can lead to a warning in __flush_work. This issue has been resolved by moving the INIT_WORK from f_midi_bind to f_midi_alloc. The affected versions are 5.4.291, 5.10.235, and prior versions. To defend against this vulnerability, Linux kernel developers and administrators should review and apply the patch to initialize work in f_midi_alloc(). They should also verify the Linux kernel version and apply the patch if necessary.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch to initialize work in f_midi_alloc()
• Verify the Linux kernel version and apply the patch if necessary
• Monitor the system for potential warnings in __flush_work
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The vulnerability is caused by the work not being initialized in the f_midi_alloc function. This can lead to a warning in __flush_work. The issue has been resolved by moving the INIT_WORK from f_midi_bind to f_midi_alloc. The affected versions are 5.4.291, 5.10.235, and prior versions. To verify, defenders should check the Linux kernel version and apply the patch if necessary. They should also monitor the system for potential warnings in __flush_work.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.