CVE-2026-74502

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) Universal MIDI Packet (UMP) driver. This vulnerability, a double free error, occurs when handling legacy raw MIDI (Musical Instrument Digital Interface) conversions. Specifically, an error during the initialization of a USB MIDI 2.0 device can cause memory to be freed twice. This can lead to memory corruption or a system crash, resulting in a Denial of Service (DoS).

The ALSA UMP legacy rawmidi initialization path contains a lifetime-management error involving the ump->out_cvts conversion array. snd_ump_attach_legacy_rawmidi() allocates this array before creating the legacy rawmidi device. If snd_rawmidi_new() subsequently fails, the error path frees ump->out_cvts but does not clear the pointer. The UMP endpoint therefore retains a dangling pointer to the freed allocation. When the endpoint is later destroyed, snd_ump_endpoint_free() attempts to free ump->out_cvts again, resulting in a kernel double free.

The host snd-usb-audio driver attaches the legacy rawmidi interface when enumerating USB MIDI 2.0 (UMP) devices, making this error path potentially reachable through a malicious or malformed USB MIDI device that can cause rawmidi initialization to fail. The issue is not network reachable. For CVSS, AV:P reflects that practical exploitation requires physical attachment of a controlled USB MIDI 2.0 device, or an equivalent environment capable of presenting an attacker-controlled USB device to the host.

The confirmed primitive is a kernel double free and the directly supported impact is memory corruption potentially resulting in a kernel crash and denial of service. Public reproductions have demonstrated the invalid second free, although reaching the required snd_rawmidi_new() failure path may depend on specific initialization failures and has also been reproduced using allocation fault injection. No reliable privilege escalation, arbitrary code execution, or attacker-visible information disclosure has been demonstrated.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Prevent the snd-usb-audio kernel module from loading by creating a configuration file in /etc/modprobe.d:

echo "install snd-usb-audio /bin/true" > /etc/modprobe.d/disable-snd-usb-audio.conf

If the module is currently loaded, unload it:

modprobe -r snd-usb-audio

Caveats: This configuration disables all USB sound and USB MIDI devices attached to the host. A system reboot may be required if the module is actively in use and cannot be unloaded immediately.