Executive brief
The Linux kernel's USB MIDI gadget driver can fail to properly initialize its work queue structure, leading to kernel warnings and potential instability. This occurs when the MIDI function is allocated but never bound, leaving an internal work queue uninitialized. If the affected code path is triggered during cleanup, the kernel will issue a warning that could disrupt system stability.
Technical details
This is a resource initialization bug in the USB f_midi gadget driver (drivers/usb/gadget/function/f_midi.c). The INIT_WORK macro, which initializes a work queue structure, was originally called only in f_midi_bind(), but f_midi_alloc() could execute independently without binding. If f_midi_alloc() completes but f_midi_bind() never runs, the work queue remains uninitialized. Later, in f_midi_free(), the uninitialized work structure is checked, and __flush_work() will trigger a warning because work->func is NULL. The fix moves INIT_WORK from f_midi_bind() to f_midi_alloc() to ensure proper initialization regardless of whether binding occurs. No network or authentication requirement; this is a local kernel subsystem issue affecting systems using USB gadget mode with MIDI functionality.
Affected products
- Linux Linux kernel Multiple versions (fix backported to 2.6.11 through 7.2)
Timeline
- 2026-09-16: disclosed: Published to NVD
- 2026-08-15: patched: Patch authored by Jeffin Philip
- 2026-09-11: patched: Merged to stable tree by Greg Kroah-Hartman