Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-90022

usb: gadget: f_midi2: fix use-after-free in string attribute show path

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_midi2: fix use-after-free in string attribute show path f_midi2_opts_str_show() takes the string lock internally, but its callers dereference the opts->info.<field> pointer before calling it, outside the lock. This races with f_midi2_opts_str_store(), which frees the old string under opts->lock when the attribute is written concurrently, the show path can read a pointer that gets freed before the lock inside str_show() is even taken. Change f_midi2_opts_str_show() to take a pointer to the string field, matching the existing pattern in f_midi2_opts_str_store(), and dereference it only after the lock is held. Update all three callers (iface_name, block name, and the EP string option macro) accordingly.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 29ee7a4dddd5caa18d1cef000f20c6af43f762f1 to < f9bdf4c4f6410a1dfafafa383a0e21069372657faffected
  • 29ee7a4dddd5caa18d1cef000f20c6af43f762f1 to < d11f3300b39e2daad2f0d9d66ddcc39a156cb594affected
  • 29ee7a4dddd5caa18d1cef000f20c6af43f762f1 to < e89e30f0b5d3004fe5955250bd8b04f3733e32ceaffected
  • 29ee7a4dddd5caa18d1cef000f20c6af43f762f1 to < 49fab5e1bdb205c36c965d0e9677bc40d282d3a2affected
  • 29ee7a4dddd5caa18d1cef000f20c6af43f762f1 to < fed0aa7c6eaedc6c0d4e362fc91724aa47be4a7baffected

Linux Linux

Default version status: affected

  • 6.6affected
  • 0 to < 6.6unaffected
  • 6.6.157 to ≤ 6.6.*unaffected
  • 6.12.110 to ≤ 6.12.*unaffected
  • 6.18.51 to ≤ 6.18.*unaffected
  • 7.2.5 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References