{"id":24712,"date":"2026-09-16T20:32:40","date_gmt":"2026-09-16T12:32:40","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90024"},"modified":"2026-09-16T20:32:40","modified_gmt":"2026-09-16T12:32:40","slug":"cve-2026-90024","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90024","title":{"rendered":"CVE-2026-90024 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: midi2: F"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs<\/p>\n<p>A null-pointer dereference occurs in f_midi2_free_ep_reqs() when attempting<br \/>\nto clean up an endpoint that was never initialized.<\/p>\n<p>When configuring the MIDI 2.0 gadget via configfs and setting the block<br \/>\ndirection to SNDRV_UMP_DIR_INPUT, the initialization of the midi1_ep_out<br \/>\nendpoint is explicitly skipped during the gadget bind phase<br \/>\n(f_midi2_bind()). As a result, the usb_ep-&gt;card field remains NULL.<\/p>\n<p>Later, when the host sets the alternate setting, f_midi2_set_alt()<br \/>\nunconditionally stops both the IN and OUT endpoints by calling<br \/>\nf_midi2_stop_eps(), which in turn calls f_midi2_free_ep_reqs() for both<br \/>\nendpoints. When f_midi2_free_ep_reqs() is called for the uninitialized<br \/>\nmidi1_ep_out, it attempts to dereference usb_ep-&gt;card to determine the<br \/>\nnumber of requests to free, leading to a crash.<\/p>\n<p>Fix this by using usb_ep-&gt;num_reqs instead of usb_ep-&gt;card-&gt;info.num_reqs<br \/>\nin f_midi2_free_ep_reqs(). usb_ep-&gt;num_reqs is correctly set during<br \/>\nf_midi2_init_ep() and remains 0 if the endpoint was never initialized,<br \/>\nsafely avoiding the loop. For consistency, apply the same change to<br \/>\nf_midi2_alloc_ep_reqs().<\/p>\n<p>Oops: general protection fault, probably for non-canonical address<br \/>\n0xdffffc00000000ee: 0000 [#1] SMP KASAN NOPTI<br \/>\nKASAN: null-ptr-deref in range [0x0000000000000770-0x0000000000000777]<br \/>\n&#8230;<br \/>\nRIP: 0010:f_midi2_free_ep_reqs drivers\/usb\/gadget\/function\/f_midi2.c:1166<br \/>\n[inline]<br \/>\nRIP: 0010:f_midi2_stop_eps+0x28e\/0x4d0<br \/>\ndrivers\/usb\/gadget\/function\/f_midi2.c:1246<br \/>\n&#8230;<br \/>\nCall Trace:<\/p>\n<p> f_midi2_set_alt+0x11c\/0xf00 drivers\/usb\/gadget\/function\/f_midi2.c:1296<br \/>\n composite_setup+0x1ffd\/0x3480 drivers\/usb\/gadget\/composite.c:1933<br \/>\n configfs_composite_setup+0xbd\/0x100 drivers\/usb\/gadget\/configfs.c:1877<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs<\/p>\n<p>A null-pointer dereference occurs in f_midi2_free_ep_reqs<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24712","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24712","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24712"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24712"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24712"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}