# CVE-2026-90024: usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs


- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Fix available:** Yes
- **Published:** 16 Sep 2026
- **Updated:** 19 Oct 2026
- **Also known as:** AZL-101288, BELL-CVE-2026-90024, DEBIAN-CVE-2026-90024, GHSA-85h2-wvw9-qf62, UBUNTU-CVE-2026-90024

## What is CVE-2026-90024?

CVE-2026-90024 is a vulnerability in Linux, published on 16 Sep 2026. 

### Official description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs

A null-pointer dereference occurs in f_midi2_free_ep_reqs() when attempting
to clean up an endpoint that was never initialized.

When configuring the MIDI 2.0 gadget via configfs and setting the block
direction to SNDRV_UMP_DIR_INPUT, the initialization of the midi1_ep_out
endpoint is explicitly skipped during the gadget bind phase
(f_midi2_bind()). As a result, the usb_ep->card field remains NULL.

Later, when the host sets the alternate setting, f_midi2_set_alt()
unconditionally stops both the IN and OUT endpoints by calling
f_midi2_stop_eps(), which in turn calls f_midi2_free_ep_reqs() for both
endpoints. When f_midi2_free_ep_reqs() is called for the uninitialized
midi1_ep_out, it attempts to dereference usb_ep->card to determine the
number of requests to free, leading to a crash.

Fix this by using usb_ep->num_reqs instead of usb_ep->card->info.num_reqs
in f_midi2_free_ep_reqs(). usb_ep->num_reqs is correctly set during
f_midi2_init_ep() and remains 0 if the endpoint was never initialized,
safely avoiding the loop. For consistency, apply the same change to
f_midi2_alloc_ep_reqs().

Oops: general protection fault, probably for non-canonical address
0xdffffc00000000ee: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000770-0x0000000000000777]
...
RIP: 0010:f_midi2_free_ep_reqs drivers/usb/gadget/function/f_midi2.c:1166
[inline]
RIP: 0010:f_midi2_stop_eps+0x28e/0x4d0
drivers/usb/gadget/function/f_midi2.c:1246
...
Call Trace:
 <TASK>
 f_midi2_set_alt+0x11c/0xf00 drivers/usb/gadget/function/f_midi2.c:1296
 composite_setup+0x1ffd/0x3480 drivers/usb/gadget/composite.c:1933
 configfs_composite_setup+0xbd/0x100 drivers/usb/gadget/configfs.c:1877

## Which versions are affected by CVE-2026-90024?


## How do I fix CVE-2026-90024?

Upgrade to a fixed version.

## Is CVE-2026-90024 being exploited?

There is no known exploitation of CVE-2026-90024 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-90024 and fix it if it is affected.

What it is: CVE-2026-90024 is a vulnerability in Linux, published on 16 Sep 2026. 
Exploitation: There is no known exploitation of CVE-2026-90024 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-90024/ (Markdown: https://insights.sbomify.com/CVE-2026-90024/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-90024
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-90024
- OSV: https://osv.dev/vulnerability/CVE-2026-90024

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-90024/
Summaries are generated and may contain mistakes; the official description above is the record.