CVE-2026-74501: ALSA: usb-audio: fix use-after-free in ump_to_endpoint()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: fix use-after-free in ump_to_endpoint()

create_midi2_ump() registers a card-owned snd_ump_endpoint and stores a
back-pointer to its per-interface snd_usb_midi2_ump object in
ump->private_data, but it never installs an ump->private_free hook and
never clears that pointer.

If a later step of snd_usb_midi_v2_create() fails, its error path calls
free_all_midi2_umps(), which kfree()s the snd_usb_midi2_ump object while
the already-registered endpoint keeps pointing at it.  The created
/dev/snd/umpC*D* node stays exposed, so the first operation of any UMP
open, ump_to_endpoint(), dereferences the dangling ump->private_data and
reads rmidi->eps[dir] out of freed memory.

A malicious USB MIDI 2.0 device that makes creation fail after the
endpoint is registered can thus trigger a slab use-after-free read on a
subsequent open of the UMP node.

Clear the endpoint's back-pointer before freeing the object, and let
ump_to_endpoint() tolerate a NULL private_data so the open/close/trigger
callbacks fail cleanly (their callers already handle a NULL endpoint)
instead of dereferencing a stale pointer.

Discovered by XBOW, triaged by Baul Lee <[email protected]>

The Linux kernel CVE team has assigned CVE-2026-74501 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.5 with commit ff49d1df79aef7580fe3ac99d17c3f886655d080 and fixed in 6.6.151 with commit 49eccef6d6e1c00dac6fb2e7eb6f9206c33e1c37
	Issue introduced in 6.5 with commit ff49d1df79aef7580fe3ac99d17c3f886655d080 and fixed in 6.12.103 with commit 8a7a33b846d6ba695891b8d0040027cdbad8cd52
	Issue introduced in 6.5 with commit ff49d1df79aef7580fe3ac99d17c3f886655d080 and fixed in 6.18.44 with commit cc014ebf803174f0e5d15956dfc5a38413c945ae
	Issue introduced in 6.5 with commit ff49d1df79aef7580fe3ac99d17c3f886655d080 and fixed in 7.1.8 with commit ae388c0e1bf727972096f770f82d12e4f748d1b6
	Issue introduced in 6.5 with commit ff49d1df79aef7580fe3ac99d17c3f886655d080 and fixed in 7.2-rc6 with commit 4a05b2d1b4642df74f30b6f54843e825c4a2bfd3

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74501
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	sound/usb/midi2.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/49eccef6d6e1c00dac6fb2e7eb6f9206c33e1c37
	https://git.kernel.org/stable/c/8a7a33b846d6ba695891b8d0040027cdbad8cd52
	https://git.kernel.org/stable/c/cc014ebf803174f0e5d15956dfc5a38413c945ae
	https://git.kernel.org/stable/c/ae388c0e1bf727972096f770f82d12e4f748d1b6
	https://git.kernel.org/stable/c/4a05b2d1b4642df74f30b6f54843e825c4a2bfd3