{
  "cveId": "CVE-2026-90024",
  "url": "https://patchblox.com/security/cve/CVE-2026-90024",
  "summary": "CVE-2026-90024 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-90024, released September 23, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs  A null-pointer dereference occurs in f_midi2_free_ep_reqs() when attempting to clean up an endpoint that was never initialized.  When configuring the MIDI 2.0 gadget via configfs and setting the block direction to SNDRV_UMP_DIR_INPUT, the initialization of the midi1_ep_out endpoint is explicitly skipped during the gadget bind phase (f_midi2_bind()). As a result, the usb_ep-\u003Ecard field remains NULL.  Later, when the host sets the alternate setting, f_midi2_set_alt() unconditionally stops both the IN and OUT endpoints by calling f_midi2_stop_eps(), which in turn calls f_midi2_free_ep_reqs() for both endpoints. When f_midi2_free_ep_reqs() is called for the uninitialized midi1_ep_out, it attempts to dereference usb_ep-\u003Ecard to determine the number of requests to free, leading to a crash.  Fix this by using usb_ep-\u003Enum_reqs instead of usb_ep-\u003Ecard-\u003Einfo.num_reqs in f_midi2_free_ep_reqs(). usb_ep-\u003Enum_reqs is correctly set during f_midi2_init_ep() and remains 0 if the endpoint was never initialized, safely avoiding the loop. For consistency, apply the same change to f_midi2_alloc_ep_reqs().  Oops: general protection fault, probably for non-canonical address 0xdffffc00000000ee: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000770-0x0000000000000777] ... RIP: 0010:f_midi2_free_ep_reqs drivers/usb/gadget/function/f_midi2.c:1166 [inline] RIP: 0010:f_midi2_stop_eps\u002B0x28e/0x4d0 drivers/usb/gadget/function/f_midi2.c:1246 ... Call Trace:  \u003CTASK\u003E  f_midi2_set_alt\u002B0x11c/0xf00 drivers/usb/gadget/function/f_midi2.c:1296  composite_setup\u002B0x1ffd/0x3480 drivers/usb/gadget/composite.c:1933  configfs_composite_setup\u002B0xbd/0x100 drivers/usb/gadget/configfs.c:1877",
  "published": "2026-09-16T11:17:15Z",
  "severity": "Moderate",
  "cvss": 4.3,
  "epss": 0.002,
  "epssPercentile": 0.09888,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-90024",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.111-1",
      "fix": "DEBIAN-CVE-2026-90024",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-90024",
      "released": "2026-09-23T19:19:02Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.6-1",
      "fix": "DEBIAN-CVE-2026-90024",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-90024",
      "released": "2026-09-23T19:19:02Z"
    },
    {
      "platform": "linux",
      "product": "linux-6.12",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.12.111-1~deb12u1",
      "fix": "DEBIAN-CVE-2026-90024",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-90024",
      "released": "2026-09-23T19:19:02Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}