From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6E2DC4EC66C for ; Wed, 16 Sep 2026 10:45:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789555570; cv=none; b=txb+Xt4wal1OYmUvhca6USjm6DGXf/rrKtTkRg1DCldFuINpMMWkSO2gHb6Tlt8y8n0t7PpB30MaTd1gTaFQA1t6fEVd4GIayTMGwpmxDKOwHqgqJQVrG0G2ZAtq67yjPELIpG8t3I2WnKUlHcbHteQHGQsBMEvjSvs6jARwmS0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789555570; c=relaxed/simple; bh=cI0qAaiyiFkHkZDgkZyDu1DcLZUGAfwckD+DPdNzE2E=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=K4aiZ6EcE1QeUu0d0BWLj4kvwvN6WsOLz0IIYjO//074R0ew4uA84csrle6EM3MY+PKu8ghQQUVBOcp3xkpiM9eWmxLOFTmyPWhBTRBd2zU+c5aJW+G/0CuaKWIs/KtWn4Odgg2nSxyEUxXeqDFsuk5A0ri3OFb53L/UUgJ9oU8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=r5gD/Vru; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="r5gD/Vru" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 01B2A1F0089A; Wed, 16 Sep 2026 10:45:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789555550; bh=P2ixWOHIoColn2+XzwFvcPQpfjav3BJ8v5fRGbF1Pl0=; h=From:To:Cc:Subject:Date:Reply-To; b=r5gD/Vruqtg6ieYIUOIaH6ASOdu3pLa6d8tdOxyy9mjWT8l4q4253SlxAwZ2CiUcH xc6IU8xzF6iGWkGtrWaLddogMWYC3IZh35zIq/1e41Q5+sEN7znvLTLL8MfJUm64JG pdi5G+sZTd3njf2IGCegUd6W3DpVKFo0pR78L+lI= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-90021: usb: gadget: f_midi: initialize work in f_midi_alloc() Date: Wed, 16 Sep 2026 11:32:31 +0100 Message-ID: <2026091604-CVE-2026-90021-e366@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2866; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=seYU864dcORqFOlWpW0glZ20aCX1hS74PPI9lg84frQ=; b=owGbwMvMwCRo6H6F97bub03G02pJDFmr8td0GzLlsOrLKP6xL/qfoX7fOTYx0+lJannHouP35 rpHe1h2xLIwCDIxyIopsnzZxnN0f8UhRS9D29Mwc1iZQIYwcHEKwES8IhgW9Bovv9dpwcFguX3O bKYq1e6+51O1GBb0d4Ut1vh11PDV/mKho2bpGzKiV3ECAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_midi: initialize work in f_midi_alloc() f_midi_alloc initializes free_ref to 1 and it can only be incremented when a sound card is registered via f_midi_register_card(). f_midi_register_card() is only called in f_midi_bind() which actually performs INIT_WORK. If f_midi_bind() is never run, work is not initialized and the if condition in f_midi_free becomes true, this results in a warning later in __flush_work as work->func = 0. Fix this by moving INIT_WORK from f_midi_bind() to f_midi_alloc(). The Linux kernel CVE team has assigned CVE-2026-90021 to this issue. Affected and fixed versions =========================== Issue introduced in 5.12 with commit 8653d71ce3763aedcf3d2331f59beda3fecd79e4 and fixed in 6.12.110 with commit 3d8b11255e632170f32f1925bfcaf96331f36317 Issue introduced in 5.12 with commit 8653d71ce3763aedcf3d2331f59beda3fecd79e4 and fixed in 6.18.51 with commit 02ac76f27db23ef652358458c272d9d2d6f51167 Issue introduced in 5.12 with commit 8653d71ce3763aedcf3d2331f59beda3fecd79e4 and fixed in 7.2.5 with commit 858576de6b2f5166b08dae803f0fd0766dcb3002 Issue introduced in 5.12 with commit 8653d71ce3763aedcf3d2331f59beda3fecd79e4 and fixed in 7.3-rc2 with commit 7e07d3e4c389217d7d7171d80edf2e23ac70f1ea Issue introduced in 5.4.291 with commit 89019ab7a64fcdf98a2ba7799e5c6aff58d4a05d Issue introduced in 5.10.235 with commit 3635523e9b96213969693c320302d536774d8e9b Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-90021 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/usb/gadget/function/f_midi.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/3d8b11255e632170f32f1925bfcaf96331f36317 https://git.kernel.org/stable/c/02ac76f27db23ef652358458c272d9d2d6f51167 https://git.kernel.org/stable/c/858576de6b2f5166b08dae803f0fd0766dcb3002 https://git.kernel.org/stable/c/7e07d3e4c389217d7d7171d80edf2e23ac70f1ea