CVE-2026-64584

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the f midi driver. The driver uses a work item midi->work handled by the f midi in work() function, which dereferences the f midi structure. This work is triggered by f midi complete() during IN-endpoint completion or f midi in trigger() during an ALSA rawmidi output-stream start. Because f midi disable() and f midi unbind() do not cancel this work, a concurrent userspace write can re-queue midi->work after f midi disable() has returned. If the work remains pending when the reference count drops to zero and f midi free() calls kfree(midi), the f midi in work() handler may dereference the structure after it has been freed.

Recommendations As a temporary mitigation, restrict the use of the f midi driver. Update the Linux kernel to a version where cancel work sync(&midi->work) is called within the refcount-zero block of the f midi free() function.