{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.187-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.101-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.6-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.101-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  usb: gadget: f_midi: cancel pending IN work before freeing the midi object  The f_midi driver embeds a work item (midi-\u003ework) whose handler, f_midi_in_work(), dereferences the enclosing struct f_midi through container_of().  This work is armed from two sites: f_midi_complete(), on a normal IN-endpoint completion, and f_midi_in_trigger(), on an ALSA rawmidi output-stream start.  Neither f_midi_disable() nor f_midi_unbind() cancels midi-\u003ework. f_midi_disable() only disables the endpoints and drains the in_req_fifo; it does not synchronize the work item, and the sound card is released asynchronously to the final free of the midi object.  The midi object is reference-counted (midi-\u003efree_ref) and is freed in f_midi_free() only once both the usb_function reference and the rawmidi private_data reference have been dropped.  In f_midi_unbind(), f_midi_disable() runs before the sound card is released, so while the USB endpoints are already disabled the rawmidi device is still usable by an open substream.  A concurrent userspace write on such a substream can reach f_midi_in_trigger() and queue midi-\u003ework again after f_midi_disable() has returned.  A work item armed this way may still be pending when the last reference drops and f_midi_free() proceeds to kfree(midi), letting f_midi_in_work() dereference the struct after it has been freed, a use-after-free.  For this reason cancelling midi-\u003ework in f_midi_disable() would not be sufficient: the ALSA trigger path can rearm the work after disable() returns.  Cancelling at the refcount-zero free site is the boundary after which neither arming source can survive, because by then both references that keep the midi object alive have been dropped: the USB endpoints are already disabled and the rawmidi device has been released.  Fix this by calling cancel_work_sync(\u0026midi-\u003ework) in the refcount-zero block of f_midi_free(), before the embedded work_struct is freed along with the rest of the structure.  opts-\u003elock is a sleeping mutex, so calling cancel_work_sync() under it is permitted, and the handler takes midi-\u003etransmit_lock rather than opts-\u003elock, so no self-deadlock can occur while it waits for a running instance of the work to finish.  This issue was found by an in-house static analysis tool.",
  "id": "DEBIAN-CVE-2026-64584",
  "modified": "2026-09-14T16:47:35.188617812Z",
  "published": "2026-08-06T08:16:33.543Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-64584"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-64584"
  ]
}