CVE-2026-74642
Unknown
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs The recent fix for UAF in ump_to_endpoint() caused another UAF because it tries to dereference the UMP endpoint object, but this might be executed at a delayed context where the endpoint has been already released. Add private_free to clear the associated data for avoiding the further dereference for delayed releases.
SeverityUnknown
CVSS—
Exploit probability—
Product
Linux
PublishedAug 22, 2026
First seenAug 22, 2026
How to fix
Update
- Linux Linuxd431941825d357be7d9ab0cb7505e3a1963bd89e, 422d8a02de5ce6a29d616d55e5ead5dec69ac1d7, d217d723c5e43881b952cdb978477f7f2dc0b6d7, f9d492a39ebeb1a56f13ec6dd165a18a48dec812, f8a80cfb68613fb7e6452b66447dbc63f435d140, 6.6.152, 6.12.104, 6.18.45, 7.1.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 49eccef6d6e1c00dac6fb2e7eb6f9206c33e1c37 ≤ v < d431941825d357be7d9ab0cb7505e3a1963bd89e, 8a7a33b846d6ba695891b8d0040027cdbad8cd52 ≤ v < 422d8a02de5ce6a29d616d55e5ead5dec69ac1d7, cc014ebf803174f0e5d15956dfc5a38413c945ae ≤ v < d217d723c5e43881b952cdb978477f7f2dc0b6d7, ae388c0e1bf727972096f770f82d12e4f748d1b6 ≤ v < f9d492a39ebeb1a56f13ec6dd165a18a48dec812, 4a05b2d1b4642df74f30b6f54843e825c4a2bfd3 ≤ v < f8a80cfb68613fb7e6452b66447dbc63f435d140, 6.6.151 ≤ v < 6.6.152, 6.12.103 ≤ v < 6.12.104, 6.18.44 ≤ v < 6.18.45, 7.1.8 ≤ v < 7.1.9 | d431941825d357be7d9ab0cb7505e3a1963bd89e, 422d8a02de5ce6a29d616d55e5ead5dec69ac1d7, d217d723c5e43881b952cdb978477f7f2dc0b6d7, f9d492a39ebeb1a56f13ec6dd165a18a48dec812, f8a80cfb68613fb7e6452b66447dbc63f435d140, 6.6.152, 6.12.104, 6.18.45, 7.1.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.