PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-90024 Linux CVE debrief

A null-pointer dereference vulnerability exists in the Linux kernel's USB gadget MIDI 2.0 driver. When configuring the MIDI 2.0 gadget via configfs and setting the block direction to SNDRV_UMP_DIR_INPUT, the initialization of the midi1_ep_out endpoint is explicitly skipped during the gadget bind phase. Later, when the host sets the alternate setting, f_midi2_set_alt() unconditionally stops both the IN and OUT endpoints by calling f_midi2_stop_eps(), which in turn calls f_midi2_free_ep_reqs() for both endpoints. This leads to a crash when f_midi2_free_ep_reqs() is called for the uninitialized midi1_ep_out endpoint.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-16
Original CVE updated
2026-10-19
Advisory published
2026-09-16
Advisory updated
2026-10-19

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems that utilize the USB gadget MIDI 2.0 driver. Specifically, operators responsible for maintaining and securing Linux-based systems, platform administrators, vulnerability management teams, and security teams should be aware of this vulnerability and take appropriate actions to mitigate its impact. This includes reviewing and applying patches, monitoring

Why it matters

This vulnerability can cause a system crash and potentially lead to data loss or corruption. Linux kernel developers and maintainers should review and apply the official patch. Linux distribution maintainers should ensure that the fix is included in their distributions. Users of Linux-based systems that utilize the USB gadget MIDI 2.0 driver should update their kernels to a version that includes the fix.

  • Denial of Service (DoS) due to system crash
  • Potential data loss or corruption due to uninitialized endpoint access

Technical summary

The vulnerability exists in the Linux kernel's USB gadget MIDI 2.0 driver. A null-pointer dereference occurs in f_midi2_free_ep_reqs() when attempting to clean up an endpoint that was never initialized. The fix uses usb_ep->num_reqs instead of usb_ep->card->info.num_reqs in f_midi2_free_ep_reqs(). This change ensures that the function can safely handle endpoints that were not initialized, preventing the null-pointer dereference and subsequent system crash. Linux kernel developers and maintainers should review and apply the official patch. Linux distribution maintainers should ensure that the fix is included in their distributions. Users of Linux-based systems that utilize the USB gadget MIDI 2.0 driver should

Defensive priority

Medium

Recommended defensive actions

  • Review and apply the official patch from the Linux kernel maintainers.
  • Ensure that the Linux kernel is updated to a version that includes the fix.
  • Monitor system logs for potential crashes or errors related to the USB gadget MIDI 2.0 driver.
  • Perform a thorough review of system configurations and ensure that the USB gadget MIDI 2.0 driver is properly configured.
  • Check for any existing compensating controls that may mitigate the vulnerability.
  • Inventory all systems that utilize the USB gadget MIDI 2.0 driver and prioritize patching based on risk and exposure.
  • Track and verify patch deployment and system stability post-patching.

Evidence notes

The vulnerability is caused by a null-pointer dereference in the f_midi2_free_ep_reqs() function. The function attempts to dereference usb_ep->card to determine the number of requests to free, leading to a crash. The fix uses usb_ep->num_reqs instead of usb_ep->card->info.num_reqs in f_midi2_free_ep_reqs().

Sources and references

Verified primary and authoritative sources

  • CVE-2026-90024 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-90024

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-90024 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-90024

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/90xxx/CVE-2026-90024.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/51ddc55c75087ac25342f6d73d3aeaf14f59bd76

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5b92f6a0c7c01efbb335d837ecdf34d38d98720f

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9c3d5091e3568ed48ac4c5b08a78eb06fad0d70a

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4079f19a0e1ce76f1e21a398f02aca150ceaaf61

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f0efaf1872949e96d213c8e910fd9517f7d7c406

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.