CVE-2026-89735

Received Received - Intake

USB Gadget MIDI2 ConfigFS Group Leak

Publication date: 2026-09-11

Last updated on: 2026-09-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: remove default configfs groups on teardown f_midi2_alloc_inst() creates default configfs child groups for the default endpoint and default block using configfs_add_default_group(), setting their internal refcount to 1. However, during function teardown in f_midi2_free_inst() or EP cleanup in f_midi2_ep_opts_release(), configfs_remove_default_groups() is never called, therefore never dropping the refcount and leaking struct f_midi2_ep_opts and f_midi2_block_opts. Add the missing configfs_remove_default_groups() in the afformentioned functions to free the structs properly.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-14

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-09-30

NVD

CVE-2026-89735

EUVD

EUVD-2026-76647

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a memory leak vulnerability in the Linux kernel's USB gadget MIDI2 driver. When creating default configfs groups for endpoints and blocks, the refcount is set but never properly decremented during cleanup. This causes structs f_midi2_ep_opts and f_midi2_block_opts to leak memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB gadget MIDI2 implementation and does not have network-based detection methods. Detection involves checking for memory leaks in the kernel related to f_midi2_ep_opts and f_midi2_block_opts structures. Use kernel logs or tools like slabtop to monitor memory usage and look for unusual growth in these structures.

Impact Analysis

The vulnerability could lead to gradual memory exhaustion on systems using the USB gadget MIDI2 driver. This may cause performance degradation, system instability, or crashes over time due to unreleased memory resources.

Compliance Impact

This vulnerability involves a memory leak in the Linux kernel's USB gadget MIDI2 subsystem due to improper cleanup of configfs groups. It does not directly impact data confidentiality, integrity, or availability in a way that would typically affect GDPR or HIPAA compliance. The issue is localized to resource management within the kernel and does not involve unauthorized data access or processing.

Mitigation Strategies

Apply the latest kernel patches that include the fix for this vulnerability. Reboot the system after patching to ensure the updated kernel is active. Monitor system memory usage post-patch to confirm the leak is resolved.

Hi! I’m here to help you understand CVE-2026-89735. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70