CVE-2026-74501
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix use-after-free in ump_to_endpoint() create_midi2_ump() registers a card-owned snd_ump_endpoint and stores a back-pointer to its per-interface snd_usb_midi2_ump object in ump->private_data, but it never installs an ump->private_free hook and never clears that pointer. If a later step of snd_usb_midi_v2_create() fails, its error path calls free_all_midi2_umps(), which kfree()s the snd_usb_midi2_ump object while the already-registered endpoint keeps pointing at it. The created /dev/snd/umpC*D* node stays exposed, so the first operation of any UMP open, ump_to_endpoint(), dereferences the dangling ump->private_data and reads rmidi->eps[dir] out of freed memory. A malicious USB MIDI 2.0 device that makes creation fail after the endpoint is registered can thus trigger a slab use-after-free read on a subsequent open of the UMP node. Clear the endpoint's back-pointer before freeing the object, and let ump_to_endpoint() tolerate a NULL private_data so the open/close/trigger callbacks fail cleanly (their callers already handle a NULL endpoint) instead of dereferencing a stale pointer. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74501
EUVD
EUVD-2026-59694

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's ALSA USB audio driver. It occurs when a USB MIDI 2.0 device triggers a failure during initialization after an endpoint is registered but before cleanup completes. The endpoint retains a dangling pointer to freed memory, which can be exploited by opening the exposed device node to read from freed memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's ALSA USB MIDI 2.0 driver and requires kernel-level detection. Check if your system uses the affected kernel version by running uname -a. Look for USB MIDI 2.0 devices connected to the system. Monitor kernel logs for errors related to ALSA or USB audio after connecting such devices.

Impact Analysis

An attacker with physical access to a vulnerable system could exploit this flaw by connecting a malicious USB MIDI 2.0 device. This could lead to arbitrary read operations from kernel memory, potentially exposing sensitive data or causing system instability. Systems using affected Linux kernel versions are at risk.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate updating is not possible, avoid using USB MIDI 2.0 devices until the kernel is patched. Monitor security advisories for kernel updates and apply them promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74501. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart