CVE-2026-74502 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
ALSA: ump: fix double free of out_cvts on rawmidi error
snd_ump_attach_legacy_rawmidi() allocates the legacy conversion array ump->out_cvts and, on the snd_rawmidi_new() error path, frees it with kfree() but leaves ump->out_cvts pointing at the freed memory. When the endpoint is later torn down, snd_ump_endpoint_free() frees ump->out_cvts a second time, resulting in a double free.
The host snd-usb-audio driver attaches the legacy rawmidi for any USB MIDI 2.0 (UMP) device, so a device that makes snd_rawmidi_new() fail reaches this path on enumeration.
Clear ump->out_cvts after freeing it on the error path so it is not freed again during teardown.
Discovered by XBOW, triaged by Baul Lee <[email protected]>
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/16/2026
This vulnerability exists within the Linux kernel's Advanced Linux Sound Architecture implementation specifically in the USB MIDI 2.0 (UMP) subsystem where a double free condition can occur during device enumeration. The flaw manifests in the snd_ump_attach_legacy_rawmidi() function which manages legacy conversion arrays for USB MIDI devices. When the snd_rawmidi_new() function fails during the attachment process, the code correctly frees the ump->out_cvts memory allocation using kfree() but fails to clear the pointer reference, leaving it pointing to freed memory location.
The technical execution of this vulnerability occurs through a classic double free scenario where the same memory region gets deallocated twice. The first deallocation happens in the error path when snd_ump_attach_legacy_rawmidi() frees ump->out_cvts with kfree() but does not nullify the pointer, followed by a second deallocation in snd_ump_endpoint_free() during normal device teardown when it attempts to free the same memory address again. This pattern creates a memory corruption condition that can lead to arbitrary code execution or system instability.
The operational impact of this vulnerability is significant for systems running Linux with USB MIDI 2.0 devices, as any USB MIDI 2.0 device that fails during the snd_rawmidi_new() enumeration phase will trigger this error path. The host snd-usb-audio driver automatically attaches legacy rawmidi interfaces to all USB MIDI 2.0 devices, making this vulnerability exploitable through standard USB MIDI device connection scenarios. The vulnerability represents a memory safety issue classified under CWE-415, specifically double free conditions that occur when the same memory region is freed multiple times.
This vulnerability aligns with ATT&CK technique T1059.007 for Command and Scripting Interpreter: Unix Shell, as exploitation could potentially involve shellcode execution through memory corruption, though direct exploitation typically requires additional conditions. The fix implemented addresses this by clearing the ump->out_cvts pointer after freeing it on the error path, preventing subsequent access to freed memory during device teardown. This remediation follows standard secure coding practices for memory management and prevents the dangerous double free scenario.
The vulnerability demonstrates a fundamental flaw in resource management where proper pointer nullification is omitted during error handling paths, creating a condition that violates memory safety principles. The fix ensures that after kfree() is called on ump->out_cvts, the pointer is explicitly set to NULL, preventing any subsequent free operations from attempting to deallocate already freed memory. This type of vulnerability represents a critical security concern in kernel space where memory corruption can lead to privilege escalation or denial of service conditions.
The remediation approach directly addresses the root cause by ensuring proper memory management during error conditions, which aligns with secure coding guidelines and industry best practices for preventing memory safety vulnerabilities in kernel drivers. The vulnerability affects systems using the snd-usb-audio driver with USB MIDI 2.0 devices and requires kernel updates to resolve the double free condition that could otherwise be exploited for system compromise or denial of service attacks.