CVE-2026-74502

Received Received - Intake

Double Free in Linux Kernel ALSA UMP

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: fix double free of out_cvts on rawmidi error snd_ump_attach_legacy_rawmidi() allocates the legacy conversion array ump->out_cvts and, on the snd_rawmidi_new() error path, frees it with kfree() but leaves ump->out_cvts pointing at the freed memory. When the endpoint is later torn down, snd_ump_endpoint_free() frees ump->out_cvts a second time, resulting in a double free. The host snd-usb-audio driver attaches the legacy rawmidi for any USB MIDI 2.0 (UMP) device, so a device that makes snd_rawmidi_new() fail reaches this path on enumeration. Clear ump->out_cvts after freeing it on the error path so it is not freed again during teardown. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74502

EUVD

EUVD-2026-59695

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a double-free vulnerability in the Linux kernel's ALSA UMP (Universal MIDI Packet) subsystem. When a USB MIDI 2.0 device fails during initialization, the kernel incorrectly frees memory twice for the same object, which can lead to memory corruption or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's ALSA UMP module and requires kernel-level detection. Check if your system is running a vulnerable kernel version by running uname -a. If the kernel version is below the patched version, the system is likely vulnerable. No network-specific detection commands are applicable.

Impact Analysis

If exploited, this could cause system instability, crashes, or potential privilege escalation. It primarily affects systems using USB MIDI 2.0 devices, as the vulnerable code path is triggered during device enumeration.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a memory management issue in the Linux kernel's ALSA UMP subsystem that could lead to system instability or crashes but does not involve data exposure or privacy violations.

Mitigation Strategies

Update the Linux kernel to the latest patched version provided by your distribution. If immediate patching is not possible, avoid using USB MIDI 2.0 (UMP) devices until the kernel is updated. Monitor kernel security advisories for updates.

Hi! I’m here to help you understand CVE-2026-74502. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70