CVE-2026-90021
Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_midi: initialize work in f_midi_alloc() f_midi_alloc initializes free_ref to 1 and it can only be incremented when a sound card is registered via f_midi_register_card(). f_midi_register_card() is only called in f_midi_bind() which actually performs INIT_WORK. If f_midi_bind() is never run, work is not initialized and the if condition in f_midi_free becomes true, this results in a warning later in __flush_work as work->func = 0. Fix this by moving INIT_WORK from f_midi_bind() to f_midi_alloc().
How to fix
- Linux Linuxc76e82b026a28c348e5d841922aa73db36eca1d3, 13e9f5a91360952b9b5bbc2367fc29d4a4ff2824, 3d8b11255e632170f32f1925bfcaf96331f36317, 02ac76f27db23ef652358458c272d9d2d6f51167, 858576de6b2f5166b08dae803f0fd0766dcb3002, 7e07d3e4c389217d7d7171d80edf2e23ac70f1ea, 5.5, 5.11 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 8653d71ce3763aedcf3d2331f59beda3fecd79e4 ≤ v < c76e82b026a28c348e5d841922aa73db36eca1d3, 8653d71ce3763aedcf3d2331f59beda3fecd79e4 ≤ v < 13e9f5a91360952b9b5bbc2367fc29d4a4ff2824, 8653d71ce3763aedcf3d2331f59beda3fecd79e4 ≤ v < 3d8b11255e632170f32f1925bfcaf96331f36317, 8653d71ce3763aedcf3d2331f59beda3fecd79e4 ≤ v < 02ac76f27db23ef652358458c272d9d2d6f51167, 8653d71ce3763aedcf3d2331f59beda3fecd79e4 ≤ v < 858576de6b2f5166b08dae803f0fd0766dcb3002, 8653d71ce3763aedcf3d2331f59beda3fecd79e4 ≤ v < 7e07d3e4c389217d7d7171d80edf2e23ac70f1ea, 89019ab7a64fcdf98a2ba7799e5c6aff58d4a05d, 3635523e9b96213969693c320302d536774d8e9b, 5.4.291 ≤ v < 5.5, 5.10.235 ≤ v < 5.11, 5.12 | c76e82b026a28c348e5d841922aa73db36eca1d3, 13e9f5a91360952b9b5bbc2367fc29d4a4ff2824, 3d8b11255e632170f32f1925bfcaf96331f36317, 02ac76f27db23ef652358458c272d9d2d6f51167, 858576de6b2f5166b08dae803f0fd0766dcb3002, 7e07d3e4c389217d7d7171d80edf2e23ac70f1ea, 5.5, 5.11 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.