CVE-2026-74642

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74642", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.922Z", "datePublished": "2026-08-22T15:32:20.418Z", "dateUpdated": "2026-08-22T15:32:20.418Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-22T15:32:20.418Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb: Fix UAF at delayed release of MIDI2 EPs\n\nThe recent fix for UAF in ump_to_endpoint() caused another UAF because\nit tries to dereference the UMP endpoint object, but this might be\nexecuted at a delayed context where the endpoint has been already\nreleased.\n\nAdd private_free to clear the associated data for avoiding the further\ndereference for delayed releases."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/midi2.c"], "versions": [{"version": "49eccef6d6e1c00dac6fb2e7eb6f9206c33e1c37", "lessThan": "d431941825d357be7d9ab0cb7505e3a1963bd89e", "status": "affected", "versionType": "git"}, {"version": "8a7a33b846d6ba695891b8d0040027cdbad8cd52", "lessThan": "422d8a02de5ce6a29d616d55e5ead5dec69ac1d7", "status": "affected", "versionType": "git"}, {"version": "cc014ebf803174f0e5d15956dfc5a38413c945ae", "lessThan": "d217d723c5e43881b952cdb978477f7f2dc0b6d7", "status": "affected", "versionType": "git"}, {"version": "ae388c0e1bf727972096f770f82d12e4f748d1b6", "lessThan": "f9d492a39ebeb1a56f13ec6dd165a18a48dec812", "status": "affected", "versionType": "git"}, {"version": "4a05b2d1b4642df74f30b6f54843e825c4a2bfd3", "lessThan": "f8a80cfb68613fb7e6452b66447dbc63f435d140", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/midi2.c"], "versions": [{"version": "6.6.151", "lessThan": "6.6.152", "status": "affected", "versionType": "semver"}, {"version": "6.12.103", "lessThan": "6.12.104", "status": "affected", "versionType": "semver"}, {"version": "6.18.44", "lessThan": "6.18.45", "status": "affected", "versionType": "semver"}, {"version": "7.1.8", "lessThan": "7.1.9", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.151", "versionEndExcluding": "6.6.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.103", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.44", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1.8", "versionEndExcluding": "7.1.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d431941825d357be7d9ab0cb7505e3a1963bd89e"}, {"url": "https://git.kernel.org/stable/c/422d8a02de5ce6a29d616d55e5ead5dec69ac1d7"}, {"url": "https://git.kernel.org/stable/c/d217d723c5e43881b952cdb978477f7f2dc0b6d7"}, {"url": "https://git.kernel.org/stable/c/f9d492a39ebeb1a56f13ec6dd165a18a48dec812"}, {"url": "https://git.kernel.org/stable/c/f8a80cfb68613fb7e6452b66447dbc63f435d140"}], "title": "ALSA: usb: Fix UAF at delayed release of MIDI2 EPs", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/usb/midi2.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d431941825d357be7d9ab0cb7505e3a1963bd89e", "status": "affected", "version": "49eccef6d6e1c00dac6fb2e7eb6f9206c33e1c37", "versionType": "git"}, {"lessThan": "422d8a02de5ce6a29d616d55e5ead5dec69ac1d7", "status": "affected", "version": "8a7a33b846d6ba695891b8d0040027cdbad8cd52", "versionType": "git"}, {"lessThan": "d217d723c5e43881b952cdb978477f7f2dc0b6d7", "status": "affected", "version": "cc014ebf803174f0e5d15956dfc5a38413c945ae", "versionType": "git"}, {"lessThan": "f9d492a39ebeb1a56f13ec6dd165a18a48dec812", "status": "affected", "version": "ae388c0e1bf727972096f770f82d12e4f748d1b6", "versionType": "git"}, {"lessThan": "f8a80cfb68613fb7e6452b66447dbc63f435d140", "status": "affected", "version": "4a05b2d1b4642df74f30b6f54843e825c4a2bfd3", "versionType": "git"}]}, {"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/usb/midi2.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6.6.152", "status": "affected", "version": "6.6.151", "versionType": "semver"}, {"lessThan": "6.12.104", "status": "affected", "version": "6.12.103", "versionType": "semver"}, {"lessThan": "6.18.45", "status": "affected", "version": "6.18.44", "versionType": "semver"}, {"lessThan": "7.1.9", "status": "affected", "version": "7.1.8", "versionType": "semver"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb: Fix UAF at delayed release of MIDI2 EPs\n\nThe recent fix for UAF in ump_to_endpoint() caused another UAF because\nit tries to dereference the UMP endpoint object, but this might be\nexecuted at a delayed context where the endpoint has been already\nreleased.\n\nAdd private_free to clear the associated data for avoiding the further\ndereference for delayed releases."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nALSA: usb: Correcci\u00f3n de UAF en la liberaci\u00f3n retrasada de los EPs MIDI2\n\nLa reciente correcci\u00f3n para UAF en ump_to_endpoint() caus\u00f3 otra UAF porque intenta desreferenciar el objeto de punto final UMP, pero esto podr\u00eda ejecutarse en un contexto retrasado donde el punto final ya ha sido liberado.\n\nA\u00f1adir private_free para limpiar los datos asociados y evitar la desreferencia posterior en liberaciones retrasadas."}], "id": "CVE-2026-74642", "lastModified": "2026-10-14T13:10:00.187", "metrics": {}, "published": "2026-08-22T16:16:37.513", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/422d8a02de5ce6a29d616d55e5ead5dec69ac1d7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d217d723c5e43881b952cdb978477f7f2dc0b6d7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d431941825d357be7d9ab0cb7505e3a1963bd89e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f8a80cfb68613fb7e6452b66447dbc63f435d140"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f9d492a39ebeb1a56f13ec6dd165a18a48dec812"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs", "id": "2521414", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521414"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nALSA: usb: Fix UAF at delayed release of MIDI2 EPs\nThe recent fix for UAF in ump_to_endpoint() caused another UAF because\nit tries to dereference the UMP endpoint object, but this might be\nexecuted at a delayed context where the endpoint has been already\nreleased.\nAdd private_free to clear the associated data for avoiding the further\ndereference for delayed releases.", "A flaw was found in the ALSA USB MIDI2 EPs component of the Linux kernel. This use-after-free (UAF) vulnerability occurs due to a delayed release of MIDI2 endpoints, leading to an attempt to dereference an already freed Universal MIDI Packet (UMP) endpoint object. An attacker could potentially exploit this memory corruption to achieve arbitrary code execution or cause a denial of service."], "name": "CVE-2026-74642", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74642\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74642\nhttps://lore.kernel.org/linux-cve-announce/2026082223-CVE-2026-74642-68fd@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[49eccef6d6e1c00dac6fb2e7eb6f9206c33e1c37,d431941825d357be7d9ab0cb7505e3a1963bd89e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8a7a33b846d6ba695891b8d0040027cdbad8cd52,422d8a02de5ce6a29d616d55e5ead5dec69ac1d7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cc014ebf803174f0e5d15956dfc5a38413c945ae,d217d723c5e43881b952cdb978477f7f2dc0b6d7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ae388c0e1bf727972096f770f82d12e4f748d1b6,f9d492a39ebeb1a56f13ec6dd165a18a48dec812)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4a05b2d1b4642df74f30b6f54843e825c4a2bfd3,f8a80cfb68613fb7e6452b66447dbc63f435d140)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.6.151,6.6.152)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.12.103,6.12.104)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.18.44,6.18.45)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.1.8,7.1.9)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T18:00:04.733998+00:00", "updated": "2026-08-25T16:00:15.262754+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-825"]}