KernelScan.io

HIGH Introduced in 6.6

usb-gadget StringAttr UAF

CVE-2026-90022

CVSS 7.8 / 10.0 NVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

KernelScan AI6.4MEDIUM

01

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_midi2: fix use-after-free in string attribute show path f_midi2_opts_str_show() takes the string lock internally, but its callers dereference the opts->info.<field> pointer before calling it, outside the lock. This races with f_midi2_opts_str_store(), which frees the old string under opts->lock when the attribute is written concurrently, the show path can read a pointer that gets freed before the lock inside str_show() is even taken. Change f_midi2_opts_str_show() to take a pointer to the string field, matching the existing pattern in f_midi2_opts_str_store(), and dereference it only after the lock is held. Update all three callers (iface_name, block name, and the EP string option macro) accordingly.

02

Engine v0.6.0

Risk summary

A use-after-free race condition exists in the USB gadget MIDI2 function's configfs string attribute handlers. A local attacker with root privileges who can concurrently read and write configfs attributes may exploit this to corrupt kernel heap memory, potentially leading to privilege escalation or denial of service. The bug requires the USB gadget MIDI2 function to be loaded and configfs to be accessible.

Affecteddrivers/usb/gadget/function/f_midi2.c (USB gadget MIDI2 function)

Vulnerability analysis

When a configfs string attribute for the USB MIDI2 gadget function is read, the show helper acquires a lock internally, but its callers dereference the string pointer before that lock is taken. If a concurrent write to the same attribute frees and replaces the old string in the window between the dereference and the lock acquisition, the show path operates on a freed pointer. The fix changes the show helper to accept a pointer to the string field rather than the string value, so the pointer is only dereferenced after the lock is held, matching the pattern already used by the store path. The vulnerable code is reachable locally through configfs by a process with root or init-namespace CAP_SYS_ADMIN privileges when the USB gadget MIDI2 function is configured.

03

BranchIntroducedFixed inPatch commit
7.26.67.2.549fab5e1bdb2
6.126.66.12.110d11f3300b39e
6.186.66.18.51e89e30f0b5d3
6.66.66.6.157f9bdf4c4f641
mainline6.67.3-rc2fed0aa7c6eae
cip/6.126.66.12.111-cip32d11f3300b39e