CVE-2026-74642

A flaw was found in the ALSA USB MIDI2 EPs component of the Linux kernel. This use-after-free (UAF) vulnerability occurs due to a delayed release of MIDI2 endpoints, leading to an attempt to dereference an already freed Universal MIDI Packet (UMP) endpoint object. An attacker could potentially exploit this memory corruption to achieve arbitrary code execution or cause a denial of service.

Red Hat has rated this vulnerability as having a Moderate impact because exploitation requires local access and the presence of an attached or emulated USB MIDI device, limiting exposure in standard enterprise deployments. While memory corruption from a use-after-free condition can compromise kernel integrity or cause a system crash, it cannot be triggered remotely over a network. Furthermore, typical headless and server environments do not load or expose USB sound interfaces to unprivileged users, significantly reducing the practical attack surface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.