Executive brief
The Linux kernel's USB gadget MIDI 2.0 function driver contains a use-after-free vulnerability in how it handles string attribute reads and writes. When device attributes (interface names, block names, endpoint names) are read from sysfs while being concurrently written, a freed memory pointer can be dereferenced, potentially causing a kernel crash or enabling code execution with kernel privileges.
Technical details
A race condition exists in the f_midi2_opts_str_show() function within the USB gadget MIDI 2.0 driver. The vulnerability occurs because callers dereference string pointers (opts->info.<field>) outside a lock before passing them to str_show(), while the concurrent f_midi2_opts_str_store() function frees the old string under the lock. This creates a window where a pointer can be freed after dereferencing but before the lock is acquired inside str_show(). The fix changes f_midi2_opts_str_show() to accept a pointer-to-pointer and dereference it only after acquiring the mutex, eliminating the race. The vulnerability affects attribute reads for iface_name, block name, and endpoint string options. The fix is available upstream and in stable kernel branches.
Affected products
- Linux Linux kernel multiple versions (f_midi2 gadget function)
Timeline
- 2026-09-16: disclosed: Published on NVD
- 2026-09-11: patched: Upstream kernel commit fed0aa7c6eaedc6c0d4e362fc91724aa47be4a7b