From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-cve-announce@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@kernel.org>
Subject: CVE-2026-90021: usb: gadget: f_midi: initialize work in f_midi_alloc()
Date: Wed, 16 Sep 2026 11:32:31 +0100 [thread overview]
Message-ID: <2026091604-CVE-2026-90021-e366@gregkh> (raw)
From: Greg Kroah-Hartman <gregkh@kernel.org>
Description
===========
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_midi: initialize work in f_midi_alloc()
f_midi_alloc initializes free_ref to 1 and it can only be incremented
when a sound card is registered via f_midi_register_card().
f_midi_register_card() is only called in f_midi_bind() which actually
performs INIT_WORK. If f_midi_bind() is never run, work is not
initialized and the if condition in f_midi_free becomes true,
this results in a warning later in __flush_work as work->func = 0.
Fix this by moving INIT_WORK from f_midi_bind() to f_midi_alloc().
The Linux kernel CVE team has assigned CVE-2026-90021 to this issue.
Affected and fixed versions
===========================
Issue introduced in 5.12 with commit 8653d71ce3763aedcf3d2331f59beda3fecd79e4 and fixed in 6.12.110 with commit 3d8b11255e632170f32f1925bfcaf96331f36317
Issue introduced in 5.12 with commit 8653d71ce3763aedcf3d2331f59beda3fecd79e4 and fixed in 6.18.51 with commit 02ac76f27db23ef652358458c272d9d2d6f51167
Issue introduced in 5.12 with commit 8653d71ce3763aedcf3d2331f59beda3fecd79e4 and fixed in 7.2.5 with commit 858576de6b2f5166b08dae803f0fd0766dcb3002
Issue introduced in 5.12 with commit 8653d71ce3763aedcf3d2331f59beda3fecd79e4 and fixed in 7.3-rc2 with commit 7e07d3e4c389217d7d7171d80edf2e23ac70f1ea
Issue introduced in 5.4.291 with commit 89019ab7a64fcdf98a2ba7799e5c6aff58d4a05d
Issue introduced in 5.10.235 with commit 3635523e9b96213969693c320302d536774d8e9b
Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.
Unaffected versions might change over time as fixes are backported to
older supported kernel versions. The official CVE entry at
https://cve.org/CVERecord/?id=CVE-2026-90021
will be updated if fixes are backported, please check that for the most
up to date information about this issue.
Affected files
==============
The file(s) affected by this issue are:
drivers/usb/gadget/function/f_midi.c
Mitigation
==========
The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes. Individual
changes are never tested alone, but rather are part of a larger kernel
release. Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all. If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
https://git.kernel.org/stable/c/3d8b11255e632170f32f1925bfcaf96331f36317
https://git.kernel.org/stable/c/02ac76f27db23ef652358458c272d9d2d6f51167
https://git.kernel.org/stable/c/858576de6b2f5166b08dae803f0fd0766dcb3002
https://git.kernel.org/stable/c/7e07d3e4c389217d7d7171d80edf2e23ac70f1ea
reply other threads:[~2026-09-16 10:45 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026091604-CVE-2026-90021-e366@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=cve@kernel.org \
--cc=gregkh@kernel.org \
--cc=linux-cve-announce@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.