CVE-2026-90024 is a vulnerability in Linux Kernel
Published on September 16, 2026
usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs
A null-pointer dereference occurs in f_midi2_free_ep_reqs() when attempting
to clean up an endpoint that was never initialized.
When configuring the MIDI 2.0 gadget via configfs and setting the block
direction to SNDRV_UMP_DIR_INPUT, the initialization of the midi1_ep_out
endpoint is explicitly skipped during the gadget bind phase
(f_midi2_bind()). As a result, the usb_ep->card field remains NULL.
Later, when the host sets the alternate setting, f_midi2_set_alt()
unconditionally stops both the IN and OUT endpoints by calling
f_midi2_stop_eps(), which in turn calls f_midi2_free_ep_reqs() for both
endpoints. When f_midi2_free_ep_reqs() is called for the uninitialized
midi1_ep_out, it attempts to dereference usb_ep->card to determine the
number of requests to free, leading to a crash.
Fix this by using usb_ep->num_reqs instead of usb_ep->card->info.num_reqs
in f_midi2_free_ep_reqs(). usb_ep->num_reqs is correctly set during
f_midi2_init_ep() and remains 0 if the endpoint was never initialized,
safely avoiding the loop. For consistency, apply the same change to
f_midi2_alloc_ep_reqs().
Oops: general protection fault, probably for non-canonical address
0xdffffc00000000ee: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000770-0x0000000000000777]
...
RIP: 0010:f_midi2_free_ep_reqs drivers/usb/gadget/function/f_midi2.c:1166
[inline]
RIP: 0010:f_midi2_stop_eps+0x28e/0x4d0
drivers/usb/gadget/function/f_midi2.c:1246
...
Call Trace:
<TASK>
f_midi2_set_alt+0x11c/0xf00 drivers/usb/gadget/function/f_midi2.c:1296
composite_setup+0x1ffd/0x3480 drivers/usb/gadget/composite.c:1933
configfs_composite_setup+0xbd/0x100 drivers/usb/gadget/configfs.c:1877
Products Associated with CVE-2026-90024
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 8b645922b22303cec4628dbbbf6c8553d1cdec87 and below 51ddc55c75087ac25342f6d73d3aeaf14f59bd76 is affected.
- Version 8b645922b22303cec4628dbbbf6c8553d1cdec87 and below 5b92f6a0c7c01efbb335d837ecdf34d38d98720f is affected.
- Version 8b645922b22303cec4628dbbbf6c8553d1cdec87 and below 9c3d5091e3568ed48ac4c5b08a78eb06fad0d70a is affected.
- Version 8b645922b22303cec4628dbbbf6c8553d1cdec87 and below 4079f19a0e1ce76f1e21a398f02aca150ceaaf61 is affected.
- Version 8b645922b22303cec4628dbbbf6c8553d1cdec87 and below f0efaf1872949e96d213c8e910fd9517f7d7c406 is affected.
- Version 6.6 is affected.
- Before 6.6 is unaffected.
- Version 6.6.157, <= 6.6.* is unaffected.
- Version 6.12.110, <= 6.12.* is unaffected.
- Version 6.18.51, <= 6.18.* is unaffected.
- Version 7.2.5, <= 7.2.* is unaffected.
- Version 7.3-rc2, <= * is unaffected.