{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-64584 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-64584 is a high-severity use after free vulnerability in Linux, published on 6 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-64584 and fix it if it is affected.\n\nWhat it is: CVE-2026-64584 is a high-severity use after free vulnerability in Linux, published on 6 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-64584 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-64584/ (Markdown: https://insights.sbomify.com/CVE-2026-64584/index.md)","id":"CVE-2026-64584","markdown":"https://insights.sbomify.com/CVE-2026-64584/index.md","name":"CVE-2026-64584","record":{"aliases":["BELL-CVE-2026-64584","DEBIAN-CVE-2026-64584","GHSA-m3h2-47px-55rm","UBUNTU-CVE-2026-64584"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel USB gadget","requires_auth":"low_privilege","summary":"A use-after-free in the Linux kernel USB MIDI gadget driver allows local attackers to execute code or escalate privileges via race conditions during device unbinding.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_midi: cancel pending IN work before freeing the midi object\n\nThe f_midi driver embeds a work item (midi-\u003ework) whose handler,\nf_midi_in_work(), dereferences the enclosing struct f_midi through\ncontainer_of().  This work is armed from two sites: f_midi_complete(),\non a normal IN-endpoint completion, and f_midi_in_trigger(), on an ALSA\nrawmidi output-stream start.\n\nNeither f_midi_disable() nor f_midi_unbind() cancels midi-\u003ework.\nf_midi_disable() only disables the endpoints and drains the in_req_fifo;\nit does not synchronize the work item, and the sound card is released\nasynchronously to the final free of the midi object.\n\nThe midi object is reference-counted (midi-\u003efree_ref) and is freed in\nf_midi_free() only once both the usb_function reference and the rawmidi\nprivate_data reference have been dropped.  In f_midi_unbind(),\nf_midi_disable() runs before the sound card is released, so while the\nUSB endpoints are already disabled the rawmidi device is still usable by\nan open substream.  A concurrent userspace write on such a substream can\nreach f_midi_in_trigger() and queue midi-\u003ework again after\nf_midi_disable() has returned.  A work item armed this way may still be\npending when the last reference drops and f_midi_free() proceeds to\nkfree(midi), letting f_midi_in_work() dereference the struct after it\nhas been freed, a use-after-free.\n\nFor this reason cancelling midi-\u003ework in f_midi_disable() would not be\nsufficient: the ALSA trigger path can rearm the work after disable()\nreturns.  Cancelling at the refcount-zero free site is the boundary\nafter which neither arming source can survive, because by then both\nreferences that keep the midi object alive have been dropped: the USB\nendpoints are already disabled and the rawmidi device has been released.\n\nFix this by calling cancel_work_sync(\u0026midi-\u003ework) in the refcount-zero\nblock of f_midi_free(), before the embedded work_struct is freed along\nwith the rest of the structure.  opts-\u003elock is a sleeping mutex, so\ncalling cancel_work_sync() under it is permitted, and the handler takes\nmidi-\u003etransmit_lock rather than opts-\u003elock, so no self-deadlock can\noccur while it waits for a running instance of the work to finish.\n\nThis issue was found by an in-house static analysis tool.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"usb: gadget: f_midi: cancel pending IN work before freeing the midi object","id":"CVE-2026-64584","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"can: esd_usb: kill anchored URBs before freeing netdevs","id":"CVE-2026-64585"},"packages":[],"prev":{"headline":"usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown","id":"CVE-2026-64583"},"products":["Linux"],"published":"2026-08-06","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-08-19","vendors":["Linux"]},"summary":"A use-after-free in the Linux kernel USB MIDI gadget driver allows local attackers to execute code or escalate privileges via race conditions during device unbinding.","url":"https://insights.sbomify.com/CVE-2026-64584/"}