Overview
The ALSA UMP core attaches a legacy rawmidi interface to every USB MIDI 2.0 device. It allocates a conversion array, and when the rawmidi registration fails it frees that array but leaves the pointer in place. When the endpoint is torn down later, the normal cleanup frees the same array again.
A USB device that makes rawmidi registration fail reaches this path during enumeration, so plugging it in is enough to trigger the double free. The fix clears the pointer after the first free.
Affected products
- Linux kernel 6.5 and later with USB MIDI 2.0 (UMP) support before the 15 Aug 2026 stable updates
Disclosure timeline
- 15 Aug 2026
- CVE-2026-74502 published by the Linux kernel CVE team; stable fixes released