CVE-2026-72443

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints MIDI 2.0 input URBs are started during sndusbmidiv2create. A later setup failure can still jump to sndusbmidiv2free, which currently frees each endpoint and its coheren...

Linux Distros Unpatched Vulnerability : CVE-2026-74502

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: ump: fix double free of outcvts on rawmidi error sndumpattachlegacyrawmidi allocates the legacy conversion array ump-outcvts and, on the sndrawmidinew err...

Linux Distros Unpatched Vulnerability : CVE-2026-74501

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: usb-audio: fix use-after-free in umptoendpoint createmidi2ump registers a card-owned sndumpendpoint and stores a back-pointer to its per-interface...

PT-2026-72954

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: fix double free of out cvts on rawmidi error snd ump attach legacy rawmidi allocates the legacy conversion array ump-out cvts and, on the snd rawmidi new error path, frees it with kfree but leaves ump-out cvts pointing...

PT-2026-72953

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix use-after-free in ump to endpoint create midi2 ump registers a card-owned snd ump endpoint and stores a back-pointer to its per-interface snd usb midi2 ump object in ump-private data, but it never installs an...

Linux Distros Unpatched Vulnerability : CVE-2026-52964

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans The USB MIDI 2.0 endpoint parser has the same descriptor walking pattern as the legacy MIDI parser. It...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fixed a race condition that could lead to UAF in sndusbmidifree. The previous commit 0718a78f6a9f “ALSA: usb-audio: Properly terminates the timer upon endpoint deletion” fixed an UAF issue caused by the error...

The vulnerability of the snd_usbmidi_output_open() function in the sound/usb/midi.c module, which is part of the Linux operating system’s USB audio device support, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the sndusbmidioutputopen function in the sound/usb/midi.c module, which supports USB audio devices in Linux operating systems, stems from the reallocation of previously freed memory due to concurrent access to resources. Exploiting this vulnerability could allow an attacker t...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-990742)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990742 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Drop sndBUGON from sndusbmidioutputopen sndusbmidioutputopen has a check of the...

EUVD-2022-54687

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Cancel pending work at closing a MIDI substream At closing a USB MIDI output substream, there might be still a pending work, which would eventually access the rawmidi runtime object that is being released. For...

SUSE CVE-2025-39997

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix race condition to UAF in sndusbmidifree The previous commit 0718a78f6a9f "ALSA: usb-audio: Kill timer properly at removal" patched a UAF issue caused by the error timer. However, because the error timer kill...

EUVD-2025-34576

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix race condition to UAF in sndusbmidifree The previous commit 0718a78f6a9f "ALSA: usb-audio: Kill timer properly at removal" patched a UAF issue caused by the error timer. However, because the error timer kill...

CVE-2025-39997

CVE-2025-39997: Linux kernel ALSA USB-Audio snd_usbmidi_free race to use-after-free. Root cause: an error timer kill added by commit 0718a78f (ALSA: usb-audio) runs after endpoint deletion, enabling a rare UAF in interrupt context; missing urb cleanup can also access freed memory. The fix is to k...

EUVD-2025-6281

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2025-21859

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - USB: gadget: fmidi: fmidicomplete to call queuework When using USB MIDI, a lock is attempted to be acquired twice through a re-entrant call to fmiditransmit,...

The vulnerability of the snd_usbmidi_free() function in the sound/usb/midi.c module of operating system kernels in Linux allows a hacker to cause a service failure.

The vulnerability of the sndusbmidifree function in the sound/usb/midi.c module of Linux kernel systems is related to improper initialization of the resource. Exploiting this vulnerability can allow attackers to cause service failures...

AZL-64505 CVE-2025-38105 affecting package kernel for versions less than 6.6.112.1-1

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill timer properly at removal The USB-audio MIDI code initializes the timer, but in a rare case, the driver might be freed without the disconnect call. This leaves the timer in an active state while the assigned...

SUSE CVE-2022-49772

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Drop sndBUGON from sndusbmidioutputopen sndusbmidioutputopen has a check of the NULL port with sndBUGON. sndBUGON was used as this shouldn't have happened, but in reality, the NULL port may be seen when the devic...

CVE-2025-21859

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: fmidi: fmidicomplete to call queuework When using USB MIDI, a lock is attempted to be acquired twice through a re-entrant call to fmiditransmit, causing a deadlock. Fix it by using queuework to schedule the inner...

CVE-2025-21859

CVE-2025-21859 affects the Linux kernel USB gadget f_midi path; a deadlock occurs when a lock is acquired twice in a re-entrant f_midi_transmit. The fix is to schedule the inner f_midi_transmit via a high-priority work queue using queue_work() from the completion handler. Patched commits are refe...