The vulnerability is a double free in the ALSA ump component of the Linux kernel. When a USB MIDI 2.0 device fails to allocate its legacy rawmidi conversion array, the array is freed but its pointer is left dangling. Subsequent teardown frees the same memory again, causing a double‑free followed by a use‑after‑free. This flaw can lead to arbitrary kernel memory corruption, potentially resulting in a system crash. The weaknesses correspond to CWE‑1341 (Double Free).

The issue occurs in the Linux kernel where the ALSA sound subsystem’s ump driver attaches legacy rawmidi for USB MIDI 2.0 devices. All kernel versions that contain the old snd_ump_attach_legacy_rawmidi implementation and have the snd_usb_audio module active are potentially affected. The fix is applied in the upstream kernel; systems running a kernel version prior to the patch must update.

The CVSS score is 7.0, and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog, so no known widespread exploitation is reported. However, the double free can be triggered by feeding a malicious USB MIDI device that causes snd_rawmidi_new to fail, which is within physical access of an attacker. The likely attack vector is a malicious USB MIDI device attached to the system. Given the potential for kernel crashes, the risk is high. The exploit is local in nature and requires device enumeration; no network‑based attack vector is documented.