CVE-2026-74501

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: fix use-after-free in ump_to_endpoint()

create_midi2_ump() registers a card-owned snd_ump_endpoint and stores a

back-pointer to its per-interface snd_usb_midi2_ump object in

ump->private_data, but it never installs an ump->private_free hook and

never clears that pointer.

If a later step of snd_usb_midi_v2_create() fails, its error path calls

free_all_midi2_umps(), which kfree()s the snd_usb_midi2_ump object while

the already-registered endpoint keeps pointing at it. The created

/dev/snd/umpC*D* node stays exposed, so the first operation of any UMP

open, ump_to_endpoint(), dereferences the dangling ump->private_data and

reads rmidi->eps[dir] out of freed memory.

A malicious USB MIDI 2.0 device that makes creation fail after the

endpoint is registered can thus trigger a slab use-after-free read on a

subsequent open of the UMP node.

Clear the endpoint's back-pointer before freeing the object, and le

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References