Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-90022— usb: gadget: f_midi2: fix use-after-free in string attribute show path

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： usb: gadget: f_midi2: 修复字符串属性 show 路径中的释放后使用（use-after-free）漏洞 函数在内部获取字符串锁，但其调用者在调用该函数之前、在锁外解引用了 指针。这与 函数存在竞态条件：当属性被并发写入时， 会在 下释放旧字符串，导致 show 路径可能在 内部获取锁之前，读取到已被释放的指针。 修复方案： 将 修改为接收指向字符串字段的指针，与现有的 的模式保持一致，并仅在持有锁之后再解引用该指针。相应地更新了所有三个调用者（if

CVSS 7.8 · High EPSS 0.17% · P6

Possible ATT&CK Techniques 1 AI

T1059.001 · PowerShell

Affected Version Matrix 12

VendorProduct Version RangeStatus
Linux Linux 29ee7a4dddd5caa18d1cef000f20c6af43f762f1< f9bdf4c4f6410a1dfafafa383a0e21069372657f affected
29ee7a4dddd5caa18d1cef000f20c6af43f762f1< d11f3300b39e2daad2f0d9d66ddcc39a156cb594 affected
29ee7a4dddd5caa18d1cef000f20c6af43f762f1< e89e30f0b5d3004fe5955250bd8b04f3733e32ce affected
29ee7a4dddd5caa18d1cef000f20c6af43f762f1< 49fab5e1bdb205c36c965d0e9677bc40d282d3a2 affected
29ee7a4dddd5caa18d1cef000f20c6af43f762f1< fed0aa7c6eaedc6c0d4e362fc91724aa47be4a7b affected
6.6 affected
< 6.6 unaffected
6.6.157≤ 6.6.* unaffected
… +4 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-90022

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
usb: gadget: f_midi2: fix use-after-free in string attribute show path
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_midi2: fix use-after-free in string attribute show path f_midi2_opts_str_show() takes the string lock internally, but its callers dereference the opts->info.<field> pointer before calling it, outside the lock. This races with f_midi2_opts_str_store(), which frees the old string under opts->lock when the attribute is written concurrently, the show path can read a pointer that gets freed before the lock inside str_show() is even taken. Change f_midi2_opts_str_show() to take a pointer to the string field, matching the existing pattern in f_midi2_opts_str_store(), and dereference it only after the lock is held. Update all three callers (iface_name, block name, and the EP string option macro) accordingly.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 29ee7a4dddd5caa18d1cef000f20c6af43f762f1 ~ f9bdf4c4f6410a1dfafafa383a0e21069372657f -
Linux Linux 6.6 -

II. Public POCs for CVE-2026-90022

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-90022

请登录查看更多情报信息。

Other References for CVE-2026-90022 (5)

Same Patch Batch · Linux · 2026-09-16 · 276 CVEs total

CVE-2026-90048 9.8 CRITICAL fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
CVE-2026-90012 9.8 CRITICAL spi: Fix DMA mapping ownership on partial map failure
CVE-2026-89970 9.8 CRITICAL nvmet-auth: Synchronize timeout work during SQ teardown
CVE-2026-89857 9.8 CRITICAL scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
CVE-2026-89969 9.8 CRITICAL nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
CVE-2026-89847 9.8 CRITICAL scsi: qla2xxx: Avoid double completion in async IOCB timeout
CVE-2026-89972 9.8 CRITICAL nvme: add missing SRCU grace period in error path
CVE-2026-89990 9.8 CRITICAL ceph: lock mutex in ceph_mds_check_access()
CVE-2026-90036 9.8 CRITICAL NFSD: Prevent client use-after-free during blocked-lock reaping
CVE-2026-90038 9.8 CRITICAL NFSD: Prevent client use-after-free during export state revocation
CVE-2026-90037 9.8 CRITICAL NFSD: Prevent client use-after-free during close_lru reaping
CVE-2026-89788 9.8 CRITICAL ksmbd: fix tree connection use-after-free in smb2_tree_connect()
CVE-2026-89783 9.8 CRITICAL xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
CVE-2026-90042 9.8 CRITICAL ceph: properly decrypt filenames in vmalloc() buffers
CVE-2026-89778 9.8 CRITICAL isofs: fix out-of-bounds page array access on empty zisofs block
CVE-2026-89916 9.3 CRITICAL KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry
CVE-2026-89915 9.3 CRITICAL KVM: arm64: Remove VM-wide VNCR mapping counter
CVE-2026-90049 9.3 CRITICAL net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
CVE-2026-89775 9.3 CRITICAL KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
CVE-2026-89918 9.3 CRITICAL KVM: arm64: Correctly handle end of VA space TLBI invalidation

Showing top 20 of 276 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-90022

No comments yet

Leave a comment