EUVD-2026-80630
GHSA-3v5g-8x87-gm3v
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Configfs gadget config needs root (PR:H) and the show-vs-store race must be won (AC:H); freed-string copy-to-user gives a marginal leak (C:L) and slab corruption (I:L), with crash-driven DoS (A:H).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_midi2: fix use-after-free in string attribute show path
f_midi2_opts_str_show() takes the string lock internally, but its callers dereference the opts->info.<field> pointer before calling it, outside the lock. This races with f_midi2_opts_str_store(), which frees the old string under opts->lock when the attribute is written concurrently, the show path can read a pointer that gets freed before the lock inside str_show() is even taken.
Change f_midi2_opts_str_show() to take a pointer to the string field, matching the existing pattern in f_midi2_opts_str_store(), and dereference it only after the lock is held. Update all three callers (iface_name, block name, and the EP string option macro) accordingly.
AnalysisAI
Use-after-free in the Linux kernel's USB MIDI 2.0 gadget function driver (f_midi2) allows a local attacker who already holds privileged access to the gadget configfs interface to corrupt or read freed memory by winning a narrow race between a string attribute's show path and a concurrent store. The show handler f_midi2_opts_str_show() dereferences opts->info.<field> before acquiring opts->lock, while f_midi2_opts_str_store() frees the previous string under that same lock, so a colliding read can touch a pointer that has already been released - affecting iface_name, block name, and the EP string option attributes. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local privileged access to the USB gadget configfs interface (CONFIG_USB_GADGET with the f_midi2 function configured; mounting and writing gadget attributes needs CAP_SYS_ADMIN). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a classic configfs attribute-handling race in the USB MIDI 2.0 gadget function driver (f_midi2), tracked as a use-after-free (CWE-416 / CWE-362). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released kernel patches: upgrade to 6.6.157, 6.12.110, 6.18.51, or 7.2.5 depending on your stable branch, or to 7.3-rc2 or later on mainline; the specific upstream commits are f9bdf4c4f6410a1dfafafa383a0e21069372657f, d11f3300b39e2daad2f0d9d66ddcc39a156cb594, e89e30f0b5d3004fe5955250bd8b04f3733e32ce, 49fab5e1bdb205c36c965d0e9677bc40d282d3a2, and fed0aa7c6eaedc6c0d4e362fc91724aa47be4a7b, per https://nvd.nist.gov/vuln/detail/CVE-2026-90022. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems that have USB gadget support and the f_midi2 driver enabled or loaded, and apply the patched kernel version specified in your Linux distribution vendor's advisory for CVE-2026-90022 (e.g., Red Hat, Ubuntu, SUSE, or Debian security updates); if immediate patching is not possible, restrict access to the gadget configfs interface to trusted administrators only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today