{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-89735",
  "modified": "2026-10-07T14:35:31Z",
  "upstream": [
    "CVE-2026-89735"
  ],
  "published": "2026-09-11T19:47:07Z",
  "summary": "usb: gadget: midi2: remove default configfs groups on teardown",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: midi2: remove default configfs groups on teardown\n\nf_midi2_alloc_inst() creates default configfs child groups for the\ndefault endpoint and default block using configfs_add_default_group(),\nsetting their internal refcount to 1.\n\nHowever, during function teardown in f_midi2_free_inst() or EP cleanup\nin f_midi2_ep_opts_release(), configfs_remove_default_groups() is\nnever called, therefore never dropping the refcount and leaking struct\nf_midi2_ep_opts and f_midi2_block_opts.\n\nAdd the missing configfs_remove_default_groups() in the afformentioned\nfunctions to free the structs properly.",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:13",
        "name": "linux"
      },
      "versions": [
        "1:6.18.39-1+rpt1"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.18.39+rpt-rpi-2712",
            "binary_version": "1:6.18.39-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.39+rpt-rpi-v6",
            "binary_version": "1:6.18.39-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.39+rpt-rpi-v7",
            "binary_version": "1:6.18.39-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.39+rpt-rpi-v8",
            "binary_version": "1:6.18.39-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.39+rpt-rpi-v8-rt",
            "binary_version": "1:6.18.39-1+rpt1"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.18.39-1+rpt1": {
            "linux_commit": "60ea684a8ace97bb0db1a16e20753bdd6ab371ff",
            "upstream_version": "6.18.39",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.18.50"
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89735"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/79dbedf40ad930f83839e564394dc5d1a54938c6"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/4beda67ee72e0c8df5b49951dd8b96f6adb25e02"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/a15c2acd3083461f91725760e59dff88b33c28f6"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/9ea5dfb2bfef4f8a7e704d1921d8a790cb7fb700"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/0f6bffb5008f0cba9cad5ded2caccc64466a6e54"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-09-14T12:06:03Z"
  }
}