CVE-2026-74501

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the ALSA usb-audio component. The create midi2 ump() function registers a snd ump endpoint and stores a back-pointer to a snd usb midi2 ump object in the ump->private data variable without installing a ump->private free hook. If snd usb midi v2 create() fails, the free all midi2 umps() function releases the snd usb midi2 ump object, leaving the registered endpoint with a dangling pointer. A malicious USB MIDI 2.0 device can trigger this failure, allowing a subsequent open of the UMP node to cause the ump to endpoint() function to dereference the freed memory via ump->private data and read rmidi->eps[dir]. This results in a slab use-after-free read.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.