{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "8b645922b22303cec4628dbbbf6c8553d1cdec87"
            },
            {
              "fixed": "51ddc55c75087ac25342f6d73d3aeaf14f59bd76"
            },
            {
              "fixed": "5b92f6a0c7c01efbb335d837ecdf34d38d98720f"
            },
            {
              "fixed": "9c3d5091e3568ed48ac4c5b08a78eb06fad0d70a"
            },
            {
              "fixed": "4079f19a0e1ce76f1e21a398f02aca150ceaaf61"
            },
            {
              "fixed": "f0efaf1872949e96d213c8e910fd9517f7d7c406"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.6.0"
            },
            {
              "fixed": "6.6.157"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.110"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.51"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90024.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs\n\nA null-pointer dereference occurs in f_midi2_free_ep_reqs() when attempting\nto clean up an endpoint that was never initialized.\n\nWhen configuring the MIDI 2.0 gadget via configfs and setting the block\ndirection to SNDRV_UMP_DIR_INPUT, the initialization of the midi1_ep_out\nendpoint is explicitly skipped during the gadget bind phase\n(f_midi2_bind()). As a result, the usb_ep-\u003ecard field remains NULL.\n\nLater, when the host sets the alternate setting, f_midi2_set_alt()\nunconditionally stops both the IN and OUT endpoints by calling\nf_midi2_stop_eps(), which in turn calls f_midi2_free_ep_reqs() for both\nendpoints. When f_midi2_free_ep_reqs() is called for the uninitialized\nmidi1_ep_out, it attempts to dereference usb_ep-\u003ecard to determine the\nnumber of requests to free, leading to a crash.\n\nFix this by using usb_ep-\u003enum_reqs instead of usb_ep-\u003ecard-\u003einfo.num_reqs\nin f_midi2_free_ep_reqs(). usb_ep-\u003enum_reqs is correctly set during\nf_midi2_init_ep() and remains 0 if the endpoint was never initialized,\nsafely avoiding the loop. For consistency, apply the same change to\nf_midi2_alloc_ep_reqs().\n\nOops: general protection fault, probably for non-canonical address\n0xdffffc00000000ee: 0000 [#1] SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000770-0x0000000000000777]\n...\nRIP: 0010:f_midi2_free_ep_reqs drivers/usb/gadget/function/f_midi2.c:1166\n[inline]\nRIP: 0010:f_midi2_stop_eps+0x28e/0x4d0\ndrivers/usb/gadget/function/f_midi2.c:1246\n...\nCall Trace:\n \u003cTASK\u003e\n f_midi2_set_alt+0x11c/0xf00 drivers/usb/gadget/function/f_midi2.c:1296\n composite_setup+0x1ffd/0x3480 drivers/usb/gadget/composite.c:1933\n configfs_composite_setup+0xbd/0x100 drivers/usb/gadget/configfs.c:1877",
  "id": "CVE-2026-90024",
  "modified": "2026-09-18T03:30:36.908411406Z",
  "published": "2026-09-16T10:33:27.624Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4079f19a0e1ce76f1e21a398f02aca150ceaaf61"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/51ddc55c75087ac25342f6d73d3aeaf14f59bd76"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5b92f6a0c7c01efbb335d837ecdf34d38d98720f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9c3d5091e3568ed48ac4c5b08a78eb06fad0d70a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f0efaf1872949e96d213c8e910fd9517f7d7c406"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90024.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90024"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs"
}