Description
In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: fix use-after-free in ump_to_endpoint()

create_midi2_ump() registers a card-owned snd_ump_endpoint and stores a
back-pointer to its per-interface snd_usb_midi2_ump object in
ump->private_data, but it never installs an ump->private_free hook and
never clears that pointer.

If a later step of snd_usb_midi_v2_create() fails, its error path calls
free_all_midi2_umps(), which kfree()s the snd_usb_midi2_ump object while
the already-registered endpoint keeps pointing at it. The created
/dev/snd/umpC*D* node stays exposed, so the first operation of any UMP
open, ump_to_endpoint(), dereferences the dangling ump->private_data and
reads rmidi->eps[dir] out of freed memory.

A malicious USB MIDI 2.0 device that makes creation fail after the
endpoint is registered can thus trigger a slab use-after-free read on a
subsequent open of the UMP node.

Clear the endpoint's back-pointer before freeing the object, and let
ump_to_endpoint() tolerate a NULL private_data so the open/close/trigger
callbacks fail cleanly (their callers already handle a NULL endpoint)
instead of dereferencing a stale pointer.

Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
Published: 2026-08-15
Score: 7.0 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a use‑after‑free in the ALSA usb‑audio subsystem: a registered UMP endpoint keeps a dangling private_data pointer after its snd_usb_midi2_ump object is freed when a device creation fails. Subsequently opening the /dev/snd/ump device dereferences this stale pointer, causing the kernel to read freed memory and potentially expose internal data or corrupt state.

Affected Systems

All Linux kernel builds that include the ALSA usb‑audio driver and expose the UMP interface are affected. No version ranges are specified, so any kernel containing the pre‑patch code is vulnerable.

Risk and Exploitability

An attacker must supply a malicious USB MIDI 2.0 device that causes the initialization to fail after an endpoint is registered. The vector is local via a physical USB connection. The EPSS score is < 1%, and the issue is not listed in CISA KEV, indicating no current public exploitation. The CVSS score of 7.0 indicates a high severity, but the use‑after‑free read could lead to information disclosure or further kernel corruption if the attacker can influence the freed memory.

Generated by OpenCVE AI on August 21, 2026 at 20:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply a kernel update that includes the ALSA usb‑audio patch
  • If an update is not yet available, disable the usb‑midi 2.0 UMP functionality via kernel parameter or module blacklist to prevent endpoint creation
  • Continuously monitor USB device activity for unexpected MIDI devices

Generated by OpenCVE AI on August 21, 2026 at 20:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6466-1 linux security update
History

Thu, 20 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate

Sat, 15 Aug 2026 14:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Sat, 15 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix use-after-free in ump_to_endpoint() create_midi2_ump() registers a card-owned snd_ump_endpoint and stores a back-pointer to its per-interface snd_usb_midi2_ump object in ump->private_data, but it never installs an ump->private_free hook and never clears that pointer. If a later step of snd_usb_midi_v2_create() fails, its error path calls free_all_midi2_umps(), which kfree()s the snd_usb_midi2_ump object while the already-registered endpoint keeps pointing at it. The created /dev/snd/umpC*D* node stays exposed, so the first operation of any UMP open, ump_to_endpoint(), dereferences the dangling ump->private_data and reads rmidi->eps[dir] out of freed memory. A malicious USB MIDI 2.0 device that makes creation fail after the endpoint is registered can thus trigger a slab use-after-free read on a subsequent open of the UMP node. Clear the endpoint's back-pointer before freeing the object, and let ump_to_endpoint() tolerate a NULL private_data so the open/close/trigger callbacks fail cleanly (their callers already handle a NULL endpoint) instead of dereferencing a stale pointer. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
Title ALSA: usb-audio: fix use-after-free in ump_to_endpoint()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-17T05:20:39.729Z

Reserved: 2026-08-15T05:44:03.907Z

Link: CVE-2026-74501

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T13:17:55.093

Modified: 2026-08-17T06:19:46.547

Link: CVE-2026-74501

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74501 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T20:30:07Z

Weaknesses