{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.105-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.8-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.107-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ALSA: ump: fix double free of out_cvts on rawmidi error  snd_ump_attach_legacy_rawmidi() allocates the legacy conversion array ump-\u003eout_cvts and, on the snd_rawmidi_new() error path, frees it with kfree() but leaves ump-\u003eout_cvts pointing at the freed memory.  When the endpoint is later torn down, snd_ump_endpoint_free() frees ump-\u003eout_cvts a second time, resulting in a double free.  The host snd-usb-audio driver attaches the legacy rawmidi for any USB MIDI 2.0 (UMP) device, so a device that makes snd_rawmidi_new() fail reaches this path on enumeration.  Clear ump-\u003eout_cvts after freeing it on the error path so it is not freed again during teardown.  Discovered by XBOW, triaged by Baul Lee \u003cbaul.lee@xbow.com\u003e",
  "id": "DEBIAN-CVE-2026-74502",
  "modified": "2026-09-19T21:47:29.643374898Z",
  "published": "2026-08-15T13:17:55.197Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-74502"
    }
  ],
  "upstream": [
    "CVE-2026-74502"
  ]
}