CVE-2026-90022

The Linux kernel's f_midi2 USB gadget driver has a use-after-free in the configfs 'show' path for its string attributes: f_midi2_opts_str_show() takes the string lock internally, but its callers dereference the string pointer before that lock is taken. A local attacker who can concurrently read and write a gadget string attribute (interface name, block name, or endpoint string) can hit a race in which the store path frees the old string under the lock while the show path is still dereferencing it outside the lock. Exploitation could yield kernel memory disclosure or corruption; the CVSS 7.8 score (local vector, high confidentiality/integrity/availability impact) indicates potential local privilege escalation. Only systems that actually instantiate the f_midi2 USB gadget function via configfs — typically embedded audio/music hardware and Linux devices emulating a USB MIDI 2.0 device — are exposed. No exploitation in the wild, public proof-of-concept, or KEV listing is known.

What to do: Apply a kernel update containing the CVE-2026-90022 fix (or the vendor backport); the specific fixed release is not stated in the provided data, so track your distro's stable kernel advisories. Restrict configfs gadget attribute permissions to root and avoid untrusted local users on systems with f_midi2 gadget instances. Check whether you are exposed by looking for the f_midi2 module loaded or gadget instances configured under the kernel's usb_gadget configfs tree.