CVE-2026-74642
Received Received - Intake

Use-After-Free in Linux Kernel ALSA USB MIDI2

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs The recent fix for UAF in ump_to_endpoint() caused another UAF because it tries to dereference the UMP endpoint object, but this might be executed at a delayed context where the endpoint has been already released. Add private_free to clear the associated data for avoiding the further dereference for delayed releases.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74642
EUVD
EUVD-2026-64579

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Use-After-Free (UAF) vulnerability in the Linux kernel's ALSA USB MIDI2 driver. It occurs when the system tries to access an endpoint object after it has already been released due to a delayed cleanup process. The fix adds a private_free mechanism to clear associated data and prevent further dereferencing of released objects.

Detection Guidance

This vulnerability is specific to the Linux kernel's ALSA USB MIDI2 endpoint handling. Detection requires checking kernel logs for UAF errors related to ump_to_endpoint() or MIDI2 endpoints. Use commands like dmesg | grep -i 'UAF\|MIDI2\|ump_to_endpoint' or journalctl -k | grep -i 'UAF\|MIDI2\|ump_to_endpoint' to identify issues.

Impact Analysis

This vulnerability could allow an attacker to cause a system crash or potentially execute arbitrary code with kernel privileges by exploiting the delayed release of MIDI2 endpoints. It primarily affects systems using USB MIDI2 audio devices.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this UAF vulnerability. Monitor kernel security advisories for kernel versions addressing CVE-2026-74642. If immediate patching is not possible, consider disabling USB MIDI2 functionality temporarily as a workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74642. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart