-

CVE-2026-74502

ALSA: ump: fix double free of out_cvts on rawmidi error

In the Linux kernel, the following vulnerability has been resolved:

ALSA: ump: fix double free of out_cvts on rawmidi error

snd_ump_attach_legacy_rawmidi() allocates the legacy conversion array
ump->out_cvts and, on the snd_rawmidi_new() error path, frees it with
kfree() but leaves ump->out_cvts pointing at the freed memory.  When the
endpoint is later torn down, snd_ump_endpoint_free() frees ump->out_cvts
a second time, resulting in a double free.

The host snd-usb-audio driver attaches the legacy rawmidi for any USB
MIDI 2.0 (UMP) device, so a device that makes snd_rawmidi_new() fail
reaches this path on enumeration.

Clear ump->out_cvts after freeing it on the error path so it is not
freed again during teardown.

Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 33cd7630782df2230529c3e8f1a6d0ae9cd6ab49
Version < e84d2e53a05c78a04d1343eeb0f31a79456e79fc
Status affected
Version 33cd7630782df2230529c3e8f1a6d0ae9cd6ab49
Version < 3302aaeac4f7ee6b775850db21d5f61064ce70ad
Status affected
Version 33cd7630782df2230529c3e8f1a6d0ae9cd6ab49
Version < 032746c2dd9a4ea0774b04ac8a29e2ea628f106e
Status affected
Version 33cd7630782df2230529c3e8f1a6d0ae9cd6ab49
Version < c57001f55f97ef856fb6527e376c5c4a056a53a4
Status affected
Version 33cd7630782df2230529c3e8f1a6d0ae9cd6ab49
Version < 70c977815af0d997feb2d0c5d284d55689bf7051
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 6.5
Status affected
Version 0
Version < 6.5
Status unaffected
Version <= 6.6.*
Version 6.6.151
Status unaffected
Version <= 6.12.*
Version 6.12.103
Status unaffected
Version <= 6.18.*
Version 6.18.44
Status unaffected
Version <= 7.1.*
Version 7.1.8
Status unaffected
Version <= *
Version 7.2
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.17% 0.065
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/e84d2e53a05c78a04d1343eeb0f31a79456e79fc
https://git.kernel.org/stable/c/3302aaeac4f7ee6b775850db21d5f61064ce70ad
https://git.kernel.org/stable/c/032746c2dd9a4ea0774b04ac8a29e2ea628f106e
https://git.kernel.org/stable/c/c57001f55f97ef856fb6527e376c5c4a056a53a4
https://git.kernel.org/stable/c/70c977815af0d997feb2d0c5d284d55689bf7051