CVE-2026-90021: usb: gadget: f_midi: initialize work in f_midi_alloc()

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-16 · updated 2026-10-30

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_midi: initialize work in f_midi_alloc() f_midi_alloc initializes free_ref to 1 and it can only be incremented when a sound card is registered via f_midi_register_card(). f_midi_register_card() is only called in f_midi_bind() which actually performs INIT_WORK. If f_midi_bind() is never run, work is not initialized and the if condition in f_midi_free becomes true, this results in a warning later in __flush_work as work->func = 0. Fix this by moving INIT_WORK from f_midi_bind() to f_midi_alloc().

Affected products

Linux: from 5.4.291 before 5.5; from 5.10.235 before 5.11 — fixed in 5.5, 5.11

How to fix

Upgrade to a fixed version: Linux 5.5, 5.11. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-90021 or the next vulnerability affects your stack