CVE-2026-74501: Linux Kernel Use-After-Free in USB MIDI 2.0 Endpoint Lookup

When snd-usb-audio sets up a USB MIDI 2.0 device, it registers a UMP endpoint and stores a back-pointer to a per-interface object in the endpoint's private data. It never installs a free hook and never clears that pointer. If a later setup step fails, the error path frees the object while the registered endpoint still points at it.

The /dev/snd/ump node stays visible, so the first thing any open does is follow that dangling pointer and read from freed memory. A malicious USB MIDI 2.0 device that makes creation fail after registration triggers the slab use-after-free on the next open. The fix clears the back-pointer before the free and makes the lookup tolerate a null value.