CVE-2026-90024

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs

A null-pointer dereference occurs in f_midi2_free_ep_reqs() when attempting

to clean up an endpoint that was never initialized.

When configuring the MIDI 2.0 gadget via configfs and setting the block

direction to SNDRV_UMP_DIR_INPUT, the initialization of the midi1_ep_out

endpoint is explicitly skipped during the gadget bind phase

(f_midi2_bind()). As a result, the usb_ep->card field remains NULL.

Later, when the host sets the alternate setting, f_midi2_set_alt()

unconditionally stops both the IN and OUT endpoints by calling

f_midi2_stop_eps(), which in turn calls f_midi2_free_ep_reqs() for both

endpoints. When f_midi2_free_ep_reqs() is called for the uninitialized

midi1_ep_out, it attempts to dereference usb_ep->card to determine the

number of requests to free, leading to a crash.

Fix this by using usb_ep->num_reqs instead of usb_ep->card->i

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References