Executive brief
The Linux kernel's USB gadget MIDI 2.0 driver has a crash vulnerability when cleaning up USB endpoints that were never fully initialized. In certain configurations, the driver attempts to access memory through a null pointer, causing the kernel to crash. This affects systems using USB gadget mode with MIDI 2.0 device emulation.
Technical details
A null-pointer dereference vulnerability exists in the f_midi2_free_ep_reqs() function within the USB gadget MIDI2 driver. The vulnerability occurs when the midi1_ep_out endpoint is skipped during initialization (when block direction is set to SNDRV_UMP_DIR_INPUT), leaving usb_ep->card as NULL. When f_midi2_set_alt() later calls f_midi2_stop_eps() and subsequently f_midi2_free_ep_reqs() on the uninitialized endpoint, the code attempts to dereference usb_ep->card to retrieve the number of requests, causing a kernel panic. The fix replaces the dereferencing of usb_ep->card->info.num_reqs with usb_ep->num_reqs, which is properly initialized to 0 for uninitialized endpoints and correctly set during f_midi2_init_ep(). No patch availability information was provided.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-16: disclosed