« Volver al listado

CVE-2026-89735

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: midi2: remove default configfs groups on teardown

f_midi2_alloc_inst() creates default configfs child groups for the default endpoint and default block using configfs_add_default_group(), setting their internal refcount to 1.

However, during function teardown in f_midi2_free_inst() or EP cleanup in f_midi2_ep_opts_release(), configfs_remove_default_groups() is never called, therefore never dropping the refcount and leaking struct f_midi2_ep_opts and f_midi2_block_opts.

Add the missing configfs_remove_default_groups() in the afformentioned functions to free the structs properly.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-89735",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "8b645922b22303cec4628dbbbf6c8553d1cdec87",
              "lessThan": "79dbedf40ad930f83839e564394dc5d1a54938c6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8b645922b22303cec4628dbbbf6c8553d1cdec87",
              "lessThan": "4beda67ee72e0c8df5b49951dd8b96f6adb25e02",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8b645922b22303cec4628dbbbf6c8553d1cdec87",
              "lessThan": "a15c2acd3083461f91725760e59dff88b33c28f6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8b645922b22303cec4628dbbbf6c8553d1cdec87",
              "lessThan": "9ea5dfb2bfef4f8a7e704d1921d8a790cb7fb700",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8b645922b22303cec4628dbbbf6c8553d1cdec87",
              "lessThan": "0f6bffb5008f0cba9cad5ded2caccc64466a6e54",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/usb/gadget/function/f_midi2.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.6",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/usb/gadget/function/f_midi2.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-11T20:20:03.967",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0f6bffb5008f0cba9cad5ded2caccc64466a6e54",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4beda67ee72e0c8df5b49951dd8b96f6adb25e02",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/79dbedf40ad930f83839e564394dc5d1a54938c6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9ea5dfb2bfef4f8a7e704d1921d8a790cb7fb700",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a15c2acd3083461f91725760e59dff88b33c28f6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: midi2: remove default configfs groups on teardown\n\nf_midi2_alloc_inst() creates default configfs child groups for the\ndefault endpoint and default block using configfs_add_default_group(),\nsetting their internal refcount to 1.\n\nHowever, during function teardown in f_midi2_free_inst() or EP cleanup\nin f_midi2_ep_opts_release(), configfs_remove_default_groups() is\nnever called, therefore never dropping the refcount and leaking struct\nf_midi2_ep_opts and f_midi2_block_opts.\n\nAdd the missing configfs_remove_default_groups() in the afformentioned\nfunctions to free the structs properly."
    }
  ],
  "lastModified": "2026-09-14T13:19:22.590",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}