CVE-2026-74501

A flaw was found in the ALSA USB audio driver of the Linux kernel. A malicious USB MIDI 2.0 device can trigger a use-after-free vulnerability by causing a creation failure after an endpoint is registered. This can lead to a slab use-after-free read when the Universal MIDI Packet (UMP) node is subsequently opened, potentially resulting in information disclosure or system instability.

A use-after-free in the ALSA USB audio MIDI 2.0 UMP path occurs because a registered snd_ump_endpoint can keep ump private_data pointing to a freed snd_usb_midi2_ump object after a later snd_usb_midi_v2_create failure path. A malicious USB MIDI 2.0 device can force this error sequence after endpoint registration and leave the /dev/snd/umpCD node exposed. A later open of the UMP node calls ump_to_endpoint and reads rmidi eps from freed slab memory, which can crash the kernel and may allow confidentiality or integrity impact if the freed object is reclaimed in a controllable way. For the CVSS the PR:N because the attacker does not need an account on the target when the attack is delivered through a malicious USB device. The issue is not remotely network reachable and normally requires physical or equivalent USB device access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.