{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-74501",
  "modified": "2026-10-07T14:35:31Z",
  "upstream": [
    "CVE-2026-74501"
  ],
  "published": "2026-08-15T12:28:42Z",
  "summary": "ALSA: usb-audio: fix use-after-free in ump_to_endpoint()",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: fix use-after-free in ump_to_endpoint()\n\ncreate_midi2_ump() registers a card-owned snd_ump_endpoint and stores a\nback-pointer to its per-interface snd_usb_midi2_ump object in\nump->private_data, but it never installs an ump->private_free hook and\nnever clears that pointer.\n\nIf a later step of snd_usb_midi_v2_create() fails, its error path calls\nfree_all_midi2_umps(), which kfree()s the snd_usb_midi2_ump object while\nthe already-registered endpoint keeps pointing at it.  The created\n/dev/snd/umpC*D* node stays exposed, so the first operation of any UMP\nopen, ump_to_endpoint(), dereferences the dangling ump->private_data and\nreads rmidi->eps[dir] out of freed memory.\n\nA malicious USB MIDI 2.0 device that makes creation fail after the\nendpoint is registered can thus trigger a slab use-after-free read on a\nsubsequent open of the UMP node.\n\nClear the endpoint's back-pointer before freeing the object, and let\nump_to_endpoint() tolerate a NULL private_data so the open/close/trigger\ncallbacks fail cleanly (their callers already handle a NULL endpoint)\ninstead of dereferencing a stale pointer.\n\nDiscovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:13",
        "name": "linux"
      },
      "versions": [
        "1:6.18.39-1+rpt1"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.18.39+rpt-rpi-2712",
            "binary_version": "1:6.18.39-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.39+rpt-rpi-v6",
            "binary_version": "1:6.18.39-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.39+rpt-rpi-v7",
            "binary_version": "1:6.18.39-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.39+rpt-rpi-v8",
            "binary_version": "1:6.18.39-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.39+rpt-rpi-v8-rt",
            "binary_version": "1:6.18.39-1+rpt1"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.18.39-1+rpt1": {
            "linux_commit": "60ea684a8ace97bb0db1a16e20753bdd6ab371ff",
            "upstream_version": "6.18.39",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.18.44"
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74501"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/49eccef6d6e1c00dac6fb2e7eb6f9206c33e1c37"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/8a7a33b846d6ba695891b8d0040027cdbad8cd52"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/cc014ebf803174f0e5d15956dfc5a38413c945ae"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ae388c0e1bf727972096f770f82d12e4f748d1b6"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/4a05b2d1b4642df74f30b6f54843e825c4a2bfd3"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-17T05:24:08Z"
  }
}