Answer in brief
CVE-2026-64584 records a High severity (CVSS 7.8) vulnerability in usb: gadget: f_midi: cancel pending IN work before freeing the midi object. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=8653d71ce3763aedcf3d2331f59beda3fecd79e4 <380b4bef46c2eb260c7a9c6bb2c5be33ce5a38f9 || >=8653d71ce3763aedcf3d2331f59beda3fecd79e4 <87bc316dd6fc90072297c635e10b9aa6075ecda1 || >=8653d71ce3763aedcf3d2331f59beda3fecd79e4 <f45089eaad0a083d71d84ff175741d7e157d9b69 || >=8653d71ce3763aedcf3d2331f59beda3fecd79e4 <ac9a51d910bb7465c554c45320cb6c09f3d0b49d || >=8653d71ce3763aedcf3d2331f59beda3fecd79e4 <5650c18d93a1db7e27cb5a40b394747eb4686d5b || 89019ab7a64fcdf98a2ba7799e5c6aff58d4a05d || 3635523e9b96213969693c320302d536774d8e9b || >=5.4.291 <5.5 || >=5.10.235 <5.11 | 380b4bef46c2eb260c7a9c6bb2c5be33ce5a38f9, 87bc316dd6fc90072297c635e10b9aa6075ecda1, f45089eaad0a083d71d84ff175741d7e157d9b69, ac9a51d910bb7465c554c45320cb6c09f3d0b49d, 5650c18d93a1db7e27cb5a40b394747eb4686d5b, 5.5, 5.11 |
| Linux/Linuxgeneric | 5.12 | Not reported |
| Linux/Linuxgeneric | >=3635523e9b96213969693c320302d536774d8e9b <f3c6f2c38062703d3dc7f86958bb0790c6959add || >=8653d71ce3763aedcf3d2331f59beda3fecd79e4 <df18150126f66817e4d3f79f309e9c92d6ff384e || >=8653d71ce3763aedcf3d2331f59beda3fecd79e4 <620955b222c47332297d6bf38f78541aa699238a || >=8653d71ce3763aedcf3d2331f59beda3fecd79e4 <380b4bef46c2eb260c7a9c6bb2c5be33ce5a38f9 || >=8653d71ce3763aedcf3d2331f59beda3fecd79e4 <87bc316dd6fc90072297c635e10b9aa6075ecda1 || >=8653d71ce3763aedcf3d2331f59beda3fecd79e4 <f45089eaad0a083d71d84ff175741d7e157d9b69 || >=8653d71ce3763aedcf3d2331f59beda3fecd79e4 <ac9a51d910bb7465c554c45320cb6c09f3d0b49d || >=8653d71ce3763aedcf3d2331f59beda3fecd79e4 <5650c18d93a1db7e27cb5a40b394747eb4686d5b || 89019ab7a64fcdf98a2ba7799e5c6aff58d4a05d || >=5.10.235 <5.10.265 || >=5.4.291 <5.5 | f3c6f2c38062703d3dc7f86958bb0790c6959add, df18150126f66817e4d3f79f309e9c92d6ff384e, 620955b222c47332297d6bf38f78541aa699238a, 380b4bef46c2eb260c7a9c6bb2c5be33ce5a38f9, 87bc316dd6fc90072297c635e10b9aa6075ecda1, f45089eaad0a083d71d84ff175741d7e157d9b69, ac9a51d910bb7465c554c45320cb6c09f3d0b49d, 5650c18d93a1db7e27cb5a40b394747eb4686d5b, 5.10.265, 5.5 |
Published upstream
Aug 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 6, 2026
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_midi: cancel pending IN work before freeing the midi object The f_midi driver embeds a work item (midi->work) whose handler, f_midi_in_work(), dereferences the enclosing struct f_midi through container_of(). This work is armed from two sites: f_midi_complete(), on a normal IN-endpoint completion, and f_midi_in_trigger(), on an ALSA rawmidi output-stream start. Neither f_midi_disable() nor f_midi_unbind() cancels midi->work. f_midi_disable() only disables the endpoints and drains the in_req_fifo; it does not synchronize the work item, and the sound card is released asynchronously to the final free of the midi object. The midi object is reference-counted (midi->free_ref) and is freed in f_midi_free() only once both the usb_function reference and the rawmidi private_data reference have been dropped. In f_midi_unbind(), f_midi_disable() runs before the sound card is released, so while the USB endpoints are already disabled the rawmidi device is still usable by an open substream. A concurrent userspace write on such a substream can reach f_midi_in_trigger() and queue midi->work again after f_midi_disable() has returned. A work item armed this way may still be pending when the last reference drops and f_midi_free() proceeds to kfree(midi), letting f_midi_in_work() dereference the struct after it has been freed, a use-after-free. For this reason cancelling midi->work in f_midi_disable() would not be sufficient: the ALSA trigger path can rearm the work after disable() returns. Cancelling at the refcount-zero free site is the boundary after which neither arming source can survive, because by then both references that keep the midi object alive have been dropped: the USB endpoints are already disabled and the rawmidi device has been released. Fix this by calling cancel_work_sync(&midi->work) in the refcount-zero block of f_midi_free(), before the embedded work_struct is freed along with the rest of the structure. opts->lock is a sleeping mutex, so calling cancel_work_sync() under it is permitted, and the handler takes midi->transmit_lock rather than opts->lock, so no self-deadlock can occur while it waits for a running instance of the work to finish. This issue was found by an in-house static analysis tool.
Quoted source text, attributed separately from HOL analysis.