cve.bz

CVE-2026-90021

no score yetEPSS 0.2%

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_midi: initialize work in f_midi_alloc() f_midi_alloc initializes free_ref to 1 and it can only be incremented when a sound card is registered via f_midi_register_card(). f_midi_register_card() is only called in f_midi_bind() which actually performs INIT_WORK. If f_midi_bind() is never run, work is not initialized and the if condition in f_midi_free becomes true, this results in a warning later in __flush_work as work->func = 0. Fix this by moving INIT_WORK from f_midi_bind() to f_midi_alloc().

EPSS
0.2% chance of exploitation in the next 30 days; higher than 10% of CVEs (scores of 2026-10-25)
Published
Modified
Record from
the NVD, synced

References

Check your stackJSON