CVE-2026-64584 in Linux
Summary
by MITRE • 08/06/2026
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_midi: cancel pending IN work before freeing the midi object
The f_midi driver embeds a work item (midi->work) whose handler, f_midi_in_work(), dereferences the enclosing struct f_midi through container_of(). This work is armed from two sites: f_midi_complete(), on a normal IN-endpoint completion, and f_midi_in_trigger(), on an ALSA rawmidi output-stream start.
Neither f_midi_disable() nor f_midi_unbind() cancels midi->work. f_midi_disable() only disables the endpoints and drains the in_req_fifo; it does not synchronize the work item, and the sound card is released asynchronously to the final free of the midi object.
The midi object is reference-counted (midi->free_ref) and is freed in f_midi_free() only once both the usb_function reference and the rawmidi private_data reference have been dropped. In f_midi_unbind(), f_midi_disable() runs before the sound card is released, so while the USB endpoints are already disabled the rawmidi device is still usable by an open substream. A concurrent userspace write on such a substream can reach f_midi_in_trigger() and queue midi->work again after f_midi_disable() has returned. A work item armed this way may still be pending when the last reference drops and f_midi_free() proceeds to kfree(midi), letting f_midi_in_work() dereference the struct after it has been freed, a use-after-free.
For this reason cancelling midi->work in f_midi_disable() would not be sufficient: the ALSA trigger path can rearm the work after disable() returns. Cancelling at the refcount-zero free site is the boundary after which neither arming source can survive, because by then both references that keep the midi object alive have been dropped: the USB endpoints are already disabled and the rawmidi device has been released.
Fix this by calling cancel_work_sync(&midi->work) in the refcount-zero block of f_midi_free(), before the embedded work_struct is freed along with the rest of the structure. opts->lock is a sleeping mutex, so calling cancel_work_sync() under it is permitted, and the handler takes midi->transmit_lock rather than opts->lock, so no self-deadlock can occur while it waits for a running instance of the work to finish.
This issue was found by an in-house static analysis tool.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/06/2026
The vulnerability resides within the Linux kernel's USB gadget function driver specifically designed for MIDI functionality known as f_midi. This driver implements a work item mechanism through the struct f_midi object's embedded work field midi->work which is managed via the container_of() macro to access the parent structure. The fundamental flaw emerges from improper synchronization of this work item during the driver's cleanup process, creating conditions ripe for use-after-free exploitation.
The technical implementation details reveal that the work item handler f_midi_in_work() operates on data contained within the struct f_midi structure, requiring proper lifecycle management to prevent access to freed memory. The work item can be scheduled from two distinct entry points: f_midi_complete() during normal USB IN-endpoint completion events and f_midi_in_trigger() when an ALSA rawmidi output stream begins processing. This dual scheduling mechanism creates a race condition window where the driver cleanup process may not adequately prevent new work items from being queued after initial disable operations have commenced.
The operational impact stems from the reference counting mechanism employed by the f_midi driver, which maintains two primary references to the struct f_midi object through midi->free_ref. The object is only fully freed in f_midi_free() once both the USB function reference and the rawmidi private_data reference have been released. During the unbind sequence, f_midi_disable() executes before the sound card release, creating a temporal gap where USB endpoints are disabled but the ALSA subsystem can still process data through open substreams. This asynchronous behavior allows concurrent userspace operations to trigger new work items even after disable has completed, leading to situations where freed memory is accessed.
This vulnerability directly maps to CWE-416 Use After Free, which specifically addresses conditions where software continues to reference memory after it has been freed by its original owner. The attack surface becomes particularly dangerous when considering the ATT&CK framework's T1059.007 technique for command and scripting interpreter, as malicious userspace processes could leverage this vulnerability to execute arbitrary code through carefully crafted MIDI data streams that trigger the use-after-free condition. The issue was identified through static analysis, highlighting the importance of automated security tooling in detecting complex synchronization bugs in kernel code.
The fix implemented addresses the root cause by introducing explicit work item cancellation at the precise moment when all references to the structure are released, specifically within the refcount-zero block of f_midi_free(). This approach ensures that no new work items can be scheduled after both critical references have been dropped, eliminating the race condition window entirely. The solution properly coordinates with existing locking mechanisms by utilizing cancel_work_sync() within the opts->lock context, which is permissible since this lock is a sleeping mutex and the work handler uses midi->transmit_lock instead, preventing potential deadlocks during synchronization. This mitigation strategy represents a robust approach to kernel memory safety that aligns with best practices for preventing use-after-free vulnerabilities in concurrent systems while maintaining proper resource lifecycle management and synchronization boundaries.