PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-90022 Linux CVE debrief

A use-after-free vulnerability exists in the Linux kernel's usb gadget driver for f_midi2. The vulnerability occurs when the string attribute show path and the string attribute store path are accessed concurrently, leading to a potential use-after-free error. This vulnerability has been resolved in the Linux kernel. An affected system could experience potential system crashes or instability, possible elevation of privileges, or denial of service (DoS) attacks. Linux system administrators and developers should assess exposure and apply patches as necessary to prevent potential system instability or security breaches.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-16
Original CVE updated
2026-10-19
Advisory published
2026-09-16
Advisory updated
2026-10-19

Who should care

Linux system administrators and developers should assess exposure and apply patches as necessary to prevent potential system instability or security breaches. This includes reviewing Linux kernel versions, monitoring updates, and inventorying Linux systems for exposure.

Why it matters

This vulnerability requires attention from Linux system administrators and developers to assess exposure and apply patches as necessary to prevent potential system instability or security breaches.

  • Potential system crashes or instability
  • Possible elevation of privileges
  • Denial of service (DoS) attacks

Technical summary

The vulnerability occurs in the Linux kernel's usb gadget driver for f_midi2, where a use-after-free error can occur when accessing the string attribute show path and store path concurrently. This has been resolved in the Linux kernel. The vulnerability requires attention from Linux system administrators and developers to assess exposure and apply patches as necessary to prevent potential system instability or security breaches. Affected systems could experience potential system crashes or instability, possible elevation of privileges, or denial of service (DoS) attacks.

Defensive priority

Medium

Recommended defensive actions

  • Review Linux kernel versions and apply patches as necessary
  • Monitor Linux kernel updates for fixes
  • Inventory Linux systems for exposure
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details about the vulnerability, including its description and affected versions. However, the corpus does not establish versions, exploitation, impact, or remediation beyond what is provided in the official sources. The vulnerability requires attention from Linux system administrators and developers to assess exposure and apply patches as necessary to prevent potential system instability or security breaches.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-90022 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-90022

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-90022 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-90022

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • usb: gadget: f_midi2: fix use-after-free in string attribute show path

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/90xxx/CVE-2026-90022.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f9bdf4c4f6410a1dfafafa383a0e21069372657f

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d11f3300b39e2daad2f0d9d66ddcc39a156cb594

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e89e30f0b5d3004fe5955250bd8b04f3733e32ce

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/49fab5e1bdb205c36c965d0e9677bc40d282d3a2

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/fed0aa7c6eaedc6c0d4e362fc91724aa47be4a7b

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.