-

CVE-2026-90021

usb: gadget: f_midi: initialize work in f_midi_alloc()

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_midi: initialize work in f_midi_alloc()

f_midi_alloc initializes free_ref to 1 and it can only be incremented
when a sound card is registered via f_midi_register_card().
f_midi_register_card() is only called in f_midi_bind() which actually
performs INIT_WORK. If f_midi_bind() is never run, work is not
initialized and the if condition in f_midi_free becomes true,
this results in a warning later in __flush_work as work->func = 0.
Fix this by moving INIT_WORK from f_midi_bind() to f_midi_alloc().
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 8653d71ce3763aedcf3d2331f59beda3fecd79e4
Version < 3d8b11255e632170f32f1925bfcaf96331f36317
Status affected
Version 8653d71ce3763aedcf3d2331f59beda3fecd79e4
Version < 02ac76f27db23ef652358458c272d9d2d6f51167
Status affected
Version 8653d71ce3763aedcf3d2331f59beda3fecd79e4
Version < 858576de6b2f5166b08dae803f0fd0766dcb3002
Status affected
Version 8653d71ce3763aedcf3d2331f59beda3fecd79e4
Version < 7e07d3e4c389217d7d7171d80edf2e23ac70f1ea
Status affected
Version 89019ab7a64fcdf98a2ba7799e5c6aff58d4a05d
Status affected
Version 3635523e9b96213969693c320302d536774d8e9b
Status affected
Version 5.4.291
Version < 5.5
Status affected
Version 5.10.235
Version < 5.11
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 5.12
Status affected
Version 0
Version < 5.12
Status unaffected
Version <= 6.12.*
Version 6.12.110
Status unaffected
Version <= 6.18.*
Version 6.18.51
Status unaffected
Version <= 7.2.*
Version 7.2.5
Status unaffected
Version <= *
Version 7.3-rc2
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.2% 0.102
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/3d8b11255e632170f32f1925bfcaf96331f36317
https://git.kernel.org/stable/c/02ac76f27db23ef652358458c272d9d2d6f51167
https://git.kernel.org/stable/c/858576de6b2f5166b08dae803f0fd0766dcb3002
https://git.kernel.org/stable/c/7e07d3e4c389217d7d7171d80edf2e23ac70f1ea