CVE-2026-74502

ALSA: ump: fix double free of out_cvts on rawmidi error

State: Published
Severity: Not scored
Published: Aug 15, 2026
Updated: Aug 17, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: ump: fix double free of out_cvts on rawmidi error

snd_ump_attach_legacy_rawmidi() allocates the legacy conversion array ump->out_cvts and, on the snd_rawmidi_new() error path, frees it with kfree() but leaves ump->out_cvts pointing at the freed memory. When the endpoint is later torn down, snd_ump_endpoint_free() frees ump->out_cvts a second time, resulting in a double free.

The host snd-usb-audio driver attaches the legacy rawmidi for any USB MIDI 2.0 (UMP) device, so a device that makes snd_rawmidi_new() fail reaches this path on enumeration.

Clear ump->out_cvts after freeing it on the error path so it is not freed again during teardown.

Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	33cd7630782df2230529c3e8f1a6d0ae9cd6ab49 to before e84d2e53a05c78a04d1343eeb0f31a79456e79fcAffected 33cd7630782df2230529c3e8f1a6d0ae9cd6ab49 to before 3302aaeac4f7ee6b775850db21d5f61064ce70adAffected 33cd7630782df2230529c3e8f1a6d0ae9cd6ab49 to before 032746c2dd9a4ea0774b04ac8a29e2ea628f106eAffected 33cd7630782df2230529c3e8f1a6d0ae9cd6ab49 to before c57001f55f97ef856fb6527e376c5c4a056a53a4Affected 33cd7630782df2230529c3e8f1a6d0ae9cd6ab49 to before 70c977815af0d997feb2d0c5d284d55689bf7051Affected
LinuxLinux	6.5Affected before 6.5Not affected 6.6.151 through 6.6.Not affected 6.12.103 through 6.12.Not affected 6.18.44 through 6.18.Not affected 7.1.8 through 7.1.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

33cd7630782df2230529c3e8f1a6d0ae9cd6ab49 to before e84d2e53a05c78a04d1343eeb0f31a79456e79fcAffected
33cd7630782df2230529c3e8f1a6d0ae9cd6ab49 to before 3302aaeac4f7ee6b775850db21d5f61064ce70adAffected
33cd7630782df2230529c3e8f1a6d0ae9cd6ab49 to before 032746c2dd9a4ea0774b04ac8a29e2ea628f106eAffected
33cd7630782df2230529c3e8f1a6d0ae9cd6ab49 to before c57001f55f97ef856fb6527e376c5c4a056a53a4Affected
33cd7630782df2230529c3e8f1a6d0ae9cd6ab49 to before 70c977815af0d997feb2d0c5d284d55689bf7051Affected

LinuxLinux

6.5Affected
before 6.5Not affected
6.6.151 through 6.6.*Not affected
6.12.103 through 6.12.*Not affected
6.18.44 through 6.18.*Not affected
7.1.8 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.