Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi: Cancel pending IN work before freeing the midi object The fmidi driver embeds a work item midi-work, and its handler, fmidiinwork, dereferences the enclosing struct fmidi through containerof. This work is...

SUSE CVE-2026-90021

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi: initialize work in fmidialloc fmidialloc initializes freeref to 1 and it can only be incremented when a sound card is registered via fmidiregistercard. fmidiregistercard is only called in fmidibind which...

CVE-2026-90021

A flaw was found in the Linux kernel's USB MIDI gadget driver fmidi. When a sound card is not registered, a work queue item may not be properly initialized. This can lead to a warning and a potential system crash, resulting in a Denial of Service DoS for a local attacker...

AZL-101144 CVE-2026-90021 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi: initialize work in fmidialloc fmidialloc initializes freeref to 1 and it can only be incremented when a sound card is registered via fmidiregistercard. fmidiregistercard is only called in fmidibind which...

DEBIAN-CVE-2026-90021

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi: initialize work in fmidialloc fmidialloc initializes freeref to 1 and it can only be incremented when a sound card is registered via fmidiregistercard. fmidiregistercard is only called in fmidibind which...

CVE-2026-90021

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi: initialize work in fmidialloc fmidialloc initializes freeref to 1 and it can only be incremented when a sound card is registered via fmidiregistercard. fmidiregistercard is only called in fmidibind which...

EUVD-2026-80629

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi: initialize work in fmidialloc fmidialloc initializes freeref to 1 and it can only be incremented when a sound card is registered via fmidiregistercard. fmidiregistercard is only called in fmidibind which...

CVE-2026-90021

In the Linux kernel , the USB gadget f_midi driver contained a bug where INIT_WORK was performed in f_midi_bind() rather than f_midi_alloc(). If f_midi_bind() was never executed, the work struct remained uninitialized, causing f_midi_free to trigger a warning in __flush_work due to work->func ...

CVE-2026-90021 usb: gadget: f_midi: initialize work in f_midi_alloc()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi: initialize work in fmidialloc fmidialloc initializes freeref to 1 and it can only be incremented when a sound card is registered via fmidiregistercard. fmidiregistercard is only called in fmidibind which...

Linux Distros Unpatched Vulnerability : CVE-2026-90021

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: fmidi: initialize work in fmidialloc fmidialloc initializes freeref to 1 and it can only be incremented when a sound card is registered via...

CVE-2026-90021: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi: initialize work in fmidialloc fmidialloc initializes freeref to 1 and it can only be incremented when a sound card is registered via fmidiregistercard. fmidiregistercard is only called in fmidibind which...

CVE-2026-64584

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi: cancel pending IN work before freeing the midi object The fmidi driver embeds a work item midi-work whose handler, fmidiinwork, dereferences the enclosing struct fmidi through containerof. This work is armed...

CVE-2026-64584 usb: gadget: f_midi: cancel pending IN work before freeing the midi object

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi: cancel pending IN work before freeing the midi object The fmidi driver embeds a work item midi-work whose handler, fmidiinwork, dereferences the enclosing struct fmidi through containerof. This work is armed...

PT-2026-68417

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the f midi driver. The driver uses a work item midi-work handled by the f midi in work function, which dereferences the f midi structure. This work is...

CVE-2026-64584: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi: cancel pending IN work before freeing the midi object The fmidi driver embeds a work item midi-work whose handler, fmidiinwork, dereferences the enclosing struct fmidi through containerof. This work is armed...

Linux Distros Unpatched Vulnerability : CVE-2026-64584

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: fmidi: cancel pending IN work before freeing the midi object The fmidi driver embeds a work item midi-work whose handler, fmidiinwork, dereferences...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001262)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001262 advisory. In the Linux kernel before 4.16.4, a double free vulnerability in the fmidisetalt function of drivers/usb/gadget/function/fmidi.c in the fmidi driver may allow...

EUVD-2018-13499

Malware in sbrugna...

Linux kernel f_midi DoS

The vulnerability of the fmidi component in the Linux operating system’s kernel is related to insufficient blocking mechanisms. Exploiting this vulnerability could allow an attacker to trigger a service failure...

SUSE CVE-2025-21859

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: fmidi: fmidicomplete to call queuework When using USB MIDI, a lock is attempted to be acquired twice through a re-entrant call to fmiditransmit, causing a deadlock. Fix it by using queuework to schedule the inner...