CVE-2026-74502ALSA: ump: fix double free of out_cvts on rawmidi error
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: fix double free of out_cvts on rawmidi error snd_ump_attach_legacy_rawmidi() allocates the legacy conversion array ump->out_cvts and, on the snd_rawmidi_new() error path, frees it with kfree() but leaves ump->out_cvts pointing at the freed memory. When the endpoint is later torn down, snd_ump_endpoint_free() frees ump->out_cvts a second time, resulting in a double free. The host snd-usb-audio driver attaches the legacy rawmidi for any USB MIDI 2.0 (UMP) device, so a device that makes snd_rawmidi_new() fail reaches this path on enumeration. Clear ump->out_cvts after freeing it on the error path so it is not freed again during teardown. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 33cd7630782df2230529c3e8f1a6d0ae9cd6ab49 before e84d2e53a05c78a04d1343eeb0f31a79456e79fc; from 33cd7630782df2230529c3e8f1a6d0ae9cd6ab49 before 3302aaeac4f7ee6b775850db21d5f61064ce70ad; from 33cd7630782df2230529c3e8f1a6d0ae9cd6ab49 before 032746c2dd9a4ea0774b04ac8a29e2ea628f106e; from 33cd7630782df2230529c3e8f1a6d0ae9cd6ab49 before c57001f55f97ef856fb6527e376c5c4a056a53a4; from 33cd7630782df2230529c3e8f1a6d0ae9cd6ab49 before 70c977815af0d997feb2d0c5d284d55689bf7051 | CNA record |
References
- https://git.kernel.org/stable/c/e84d2e53a05c78a04d1343eeb0f31a79456e79fc
- https://git.kernel.org/stable/c/3302aaeac4f7ee6b775850db21d5f61064ce70ad
- https://git.kernel.org/stable/c/032746c2dd9a4ea0774b04ac8a29e2ea628f106e
- https://git.kernel.org/stable/c/c57001f55f97ef856fb6527e376c5c4a056a53a4
- https://git.kernel.org/stable/c/70c977815af0d997feb2d0c5d284d55689bf7051
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.