GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-64584 (GCVE-0-2026-64584)

Vulnerability from cvelistv5 – Published: 2026-08-06 07:06 – Updated: 2026-08-19 16:29
VLAI
Title
usb: gadget: f_midi: cancel pending IN work before freeing the midi object
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_midi: cancel pending IN work before freeing the midi object The f_midi driver embeds a work item (midi->work) whose handler, f_midi_in_work(), dereferences the enclosing struct f_midi through container_of(). This work is armed from two sites: f_midi_complete(), on a normal IN-endpoint completion, and f_midi_in_trigger(), on an ALSA rawmidi output-stream start. Neither f_midi_disable() nor f_midi_unbind() cancels midi->work. f_midi_disable() only disables the endpoints and drains the in_req_fifo; it does not synchronize the work item, and the sound card is released asynchronously to the final free of the midi object. The midi object is reference-counted (midi->free_ref) and is freed in f_midi_free() only once both the usb_function reference and the rawmidi private_data reference have been dropped. In f_midi_unbind(), f_midi_disable() runs before the sound card is released, so while the USB endpoints are already disabled the rawmidi device is still usable by an open substream. A concurrent userspace write on such a substream can reach f_midi_in_trigger() and queue midi->work again after f_midi_disable() has returned. A work item armed this way may still be pending when the last reference drops and f_midi_free() proceeds to kfree(midi), letting f_midi_in_work() dereference the struct after it has been freed, a use-after-free. For this reason cancelling midi->work in f_midi_disable() would not be sufficient: the ALSA trigger path can rearm the work after disable() returns. Cancelling at the refcount-zero free site is the boundary after which neither arming source can survive, because by then both references that keep the midi object alive have been dropped: the USB endpoints are already disabled and the rawmidi device has been released. Fix this by calling cancel_work_sync(&midi->work) in the refcount-zero block of f_midi_free(), before the embedded work_struct is freed along with the rest of the structure. opts->lock is a sleeping mutex, so calling cancel_work_sync() under it is permitted, and the handler takes midi->transmit_lock rather than opts->lock, so no self-deadlock can occur while it waits for a running instance of the work to finish. This issue was found by an in-house static analysis tool.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3635523e9b96213969693c320302d536774d8e9b , < f3c6f2c38062703d3dc7f86958bb0790c6959add (git)
Affected: 8653d71ce3763aedcf3d2331f59beda3fecd79e4 , < df18150126f66817e4d3f79f309e9c92d6ff384e (git)
Affected: 8653d71ce3763aedcf3d2331f59beda3fecd79e4 , < 620955b222c47332297d6bf38f78541aa699238a (git)
Affected: 8653d71ce3763aedcf3d2331f59beda3fecd79e4 , < 380b4bef46c2eb260c7a9c6bb2c5be33ce5a38f9 (git)
Affected: 8653d71ce3763aedcf3d2331f59beda3fecd79e4 , < 87bc316dd6fc90072297c635e10b9aa6075ecda1 (git)
Affected: 8653d71ce3763aedcf3d2331f59beda3fecd79e4 , < f45089eaad0a083d71d84ff175741d7e157d9b69 (git)
Affected: 8653d71ce3763aedcf3d2331f59beda3fecd79e4 , < ac9a51d910bb7465c554c45320cb6c09f3d0b49d (git)
Affected: 8653d71ce3763aedcf3d2331f59beda3fecd79e4 , < 5650c18d93a1db7e27cb5a40b394747eb4686d5b (git)
Affected: 89019ab7a64fcdf98a2ba7799e5c6aff58d4a05d (git)
Affected: 5.10.235 , < 5.10.265 (semver)
Affected: 5.4.291 , < 5.5 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.12
Unaffected: 0 , < 5.12 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_midi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f3c6f2c38062703d3dc7f86958bb0790c6959add",
              "status": "affected",
              "version": "3635523e9b96213969693c320302d536774d8e9b",
              "versionType": "git"
            },
            {
              "lessThan": "df18150126f66817e4d3f79f309e9c92d6ff384e",
              "status": "affected",
              "version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
              "versionType": "git"
            },
            {
              "lessThan": "620955b222c47332297d6bf38f78541aa699238a",
              "status": "affected",
              "version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
              "versionType": "git"
            },
            {
              "lessThan": "380b4bef46c2eb260c7a9c6bb2c5be33ce5a38f9",
              "status": "affected",
              "version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
              "versionType": "git"
            },
            {
              "lessThan": "87bc316dd6fc90072297c635e10b9aa6075ecda1",
              "status": "affected",
              "version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
              "versionType": "git"
            },
            {
              "lessThan": "f45089eaad0a083d71d84ff175741d7e157d9b69",
              "status": "affected",
              "version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
              "versionType": "git"
            },
            {
              "lessThan": "ac9a51d910bb7465c554c45320cb6c09f3d0b49d",
              "status": "affected",
              "version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
              "versionType": "git"
            },
            {
              "lessThan": "5650c18d93a1db7e27cb5a40b394747eb4686d5b",
              "status": "affected",
              "version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "89019ab7a64fcdf98a2ba7799e5c6aff58d4a05d",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.265",
              "status": "affected",
              "version": "5.10.235",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.291",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_midi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "5.10.235",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.291",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_midi: cancel pending IN work before freeing the midi object\n\nThe f_midi driver embeds a work item (midi-\u003ework) whose handler,\nf_midi_in_work(), dereferences the enclosing struct f_midi through\ncontainer_of().  This work is armed from two sites: f_midi_complete(),\non a normal IN-endpoint completion, and f_midi_in_trigger(), on an ALSA\nrawmidi output-stream start.\n\nNeither f_midi_disable() nor f_midi_unbind() cancels midi-\u003ework.\nf_midi_disable() only disables the endpoints and drains the in_req_fifo;\nit does not synchronize the work item, and the sound card is released\nasynchronously to the final free of the midi object.\n\nThe midi object is reference-counted (midi-\u003efree_ref) and is freed in\nf_midi_free() only once both the usb_function reference and the rawmidi\nprivate_data reference have been dropped.  In f_midi_unbind(),\nf_midi_disable() runs before the sound card is released, so while the\nUSB endpoints are already disabled the rawmidi device is still usable by\nan open substream.  A concurrent userspace write on such a substream can\nreach f_midi_in_trigger() and queue midi-\u003ework again after\nf_midi_disable() has returned.  A work item armed this way may still be\npending when the last reference drops and f_midi_free() proceeds to\nkfree(midi), letting f_midi_in_work() dereference the struct after it\nhas been freed, a use-after-free.\n\nFor this reason cancelling midi-\u003ework in f_midi_disable() would not be\nsufficient: the ALSA trigger path can rearm the work after disable()\nreturns.  Cancelling at the refcount-zero free site is the boundary\nafter which neither arming source can survive, because by then both\nreferences that keep the midi object alive have been dropped: the USB\nendpoints are already disabled and the rawmidi device has been released.\n\nFix this by calling cancel_work_sync(\u0026midi-\u003ework) in the refcount-zero\nblock of f_midi_free(), before the embedded work_struct is freed along\nwith the rest of the structure.  opts-\u003elock is a sleeping mutex, so\ncalling cancel_work_sync() under it is permitted, and the handler takes\nmidi-\u003etransmit_lock rather than opts-\u003elock, so no self-deadlock can\noccur while it waits for a running instance of the work to finish.\n\nThis issue was found by an in-house static analysis tool."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is reached by local configfs UDC clear or function unlink (unregister_gadget \u2192 f_midi_unbind/disable) plus ALSA rawmidi write/close on /dev/snd/midi*; no USB host traffic or cable access is required, and dummy_hcd suffices, matching other gadget teardown UAFs scored AV:L.\nAC:L - The attacker controls both sides of the race: opening/writing the rawmidi substream to queue midi-\u003ework via f_midi_in_trigger after disable, and forcing unbind plus dropping the last free_ref via configfs unlink/close, so the window is freely repeatable.\nPR:L - Exploitation needs access to the gadget configfs tree and/or the ALSA MIDI node; both are routinely delegated to non-root system/audio accounts on Android and embedded MIDI gadgets, with no capability check on the rawmidi write or UDC store path itself.\nUI:N - The attacker performs the full sequence\u2014configfs unbind/unlink, rawmidi write to rearm work, and close to free the midi object\u2014without any action by another user or administrator.\nS:U - The use-after-free corrupts kernel heap within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - f_midi_in_work() container_of()s the freed embedded work_struct and then reads midi-\u003ein_ep, fifo, and port/substream fields; reclaiming the freed f_midi slab yields a classic UAF read/disclosure primitive.\nI:H - Post-free f_midi_transmit()/f_midi_drop_out_substreams() write through the reclaimed object (port state, kfifo, snd_rawmidi_drop_output), giving a heap write-after-free primitive suitable for control-flow hijack.\nA:H - Dereferencing the freed f_midi from system_highpri_wq reliably produces KASAN reports, oops, or kernel panic even without full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:29:12.890Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f3c6f2c38062703d3dc7f86958bb0790c6959add"
        },
        {
          "url": "https://git.kernel.org/stable/c/df18150126f66817e4d3f79f309e9c92d6ff384e"
        },
        {
          "url": "https://git.kernel.org/stable/c/620955b222c47332297d6bf38f78541aa699238a"
        },
        {
          "url": "https://git.kernel.org/stable/c/380b4bef46c2eb260c7a9c6bb2c5be33ce5a38f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/87bc316dd6fc90072297c635e10b9aa6075ecda1"
        },
        {
          "url": "https://git.kernel.org/stable/c/f45089eaad0a083d71d84ff175741d7e157d9b69"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac9a51d910bb7465c554c45320cb6c09f3d0b49d"
        },
        {
          "url": "https://git.kernel.org/stable/c/5650c18d93a1db7e27cb5a40b394747eb4686d5b"
        }
      ],
      "title": "usb: gadget: f_midi: cancel pending IN work before freeing the midi object",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64584",
    "datePublished": "2026-08-06T07:06:25.953Z",
    "dateReserved": "2026-07-19T15:36:31.798Z",
    "dateUpdated": "2026-08-19T16:29:12.890Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64584",
      "date": "2026-09-18",
      "epss": "0.00117",
      "percentile": "0.01888"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-09T01:43:45.000Z",
      "cve": "CVE-2026-64584",
      "id": "msrc_CVE-2026-64584",
      "initial_release_date": "2026-08-07T01:16:16.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "usb: gadget: f_midi: cancel pending IN work before freeing the midi object",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64584.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/usb/gadget/function/f_midi.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "f3c6f2c38062703d3dc7f86958bb0790c6959add",
                    "status": "affected",
                    "version": "3635523e9b96213969693c320302d536774d8e9b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "df18150126f66817e4d3f79f309e9c92d6ff384e",
                    "status": "affected",
                    "version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "620955b222c47332297d6bf38f78541aa699238a",
                    "status": "affected",
                    "version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "380b4bef46c2eb260c7a9c6bb2c5be33ce5a38f9",
                    "status": "affected",
                    "version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "87bc316dd6fc90072297c635e10b9aa6075ecda1",
                    "status": "affected",
                    "version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f45089eaad0a083d71d84ff175741d7e157d9b69",
                    "status": "affected",
                    "version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ac9a51d910bb7465c554c45320cb6c09f3d0b49d",
                    "status": "affected",
                    "version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5650c18d93a1db7e27cb5a40b394747eb4686d5b",
                    "status": "affected",
                    "version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "89019ab7a64fcdf98a2ba7799e5c6aff58d4a05d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.10.265",
                    "status": "affected",
                    "version": "5.10.235",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.5",
                    "status": "affected",
                    "version": "5.4.291",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/usb/gadget/function/f_midi.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.12"
                  },
                  {
                    "lessThan": "5.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.265",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.216",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.148",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.101",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_midi: cancel pending IN work before freeing the midi object\n\nThe f_midi driver embeds a work item (midi-\u003ework) whose handler,\nf_midi_in_work(), dereferences the enclosing struct f_midi through\ncontainer_of().  This work is armed from two sites: f_midi_complete(),\non a normal IN-endpoint completion, and f_midi_in_trigger(), on an ALSA\nrawmidi output-stream start.\n\nNeither f_midi_disable() nor f_midi_unbind() cancels midi-\u003ework.\nf_midi_disable() only disables the endpoints and drains the in_req_fifo;\nit does not synchronize the work item, and the sound card is released\nasynchronously to the final free of the midi object.\n\nThe midi object is reference-counted (midi-\u003efree_ref) and is freed in\nf_midi_free() only once both the usb_function reference and the rawmidi\nprivate_data reference have been dropped.  In f_midi_unbind(),\nf_midi_disable() runs before the sound card is released, so while the\nUSB endpoints are already disabled the rawmidi device is still usable by\nan open substream.  A concurrent userspace write on such a substream can\nreach f_midi_in_trigger() and queue midi-\u003ework again after\nf_midi_disable() has returned.  A work item armed this way may still be\npending when the last reference drops and f_midi_free() proceeds to\nkfree(midi), letting f_midi_in_work() dereference the struct after it\nhas been freed, a use-after-free.\n\nFor this reason cancelling midi-\u003ework in f_midi_disable() would not be\nsufficient: the ALSA trigger path can rearm the work after disable()\nreturns.  Cancelling at the refcount-zero free site is the boundary\nafter which neither arming source can survive, because by then both\nreferences that keep the midi object alive have been dropped: the USB\nendpoints are already disabled and the rawmidi device has been released.\n\nFix this by calling cancel_work_sync(\u0026midi-\u003ework) in the refcount-zero\nblock of f_midi_free(), before the embedded work_struct is freed along\nwith the rest of the structure.  opts-\u003elock is a sleeping mutex, so\ncalling cancel_work_sync() under it is permitted, and the handler takes\nmidi-\u003etransmit_lock rather than opts-\u003elock, so no self-deadlock can\noccur while it waits for a running instance of the work to finish.\n\nThis issue was found by an in-house static analysis tool."
          }
        ],
        "id": "CVE-2026-64584",
        "lastModified": "2026-08-19T17:20:18.703",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-06T08:16:33.543",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/380b4bef46c2eb260c7a9c6bb2c5be33ce5a38f9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5650c18d93a1db7e27cb5a40b394747eb4686d5b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/620955b222c47332297d6bf38f78541aa699238a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/87bc316dd6fc90072297c635e10b9aa6075ecda1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ac9a51d910bb7465c554c45320cb6c09f3d0b49d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/df18150126f66817e4d3f79f309e9c92d6ff384e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f3c6f2c38062703d3dc7f86958bb0790c6959add"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f45089eaad0a083d71d84ff175741d7e157d9b69"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:37:33Z",
      "cve": "CVE-2026-64584",
      "id": "CVE-2026-64584",
      "initial_release_date": "2026-08-06T23:56:00Z",
      "product_status:known_affected": "528",
      "product_status:known_not_affected": "203",
      "product_status:recommended": "111",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64584",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64584.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.