Null-Pointer Dereference in Linux Kernel USB MIDI Gadget

CVE-2026-90024

What is CVE-2026-90024?

A null-pointer dereference vulnerability has been identified in the Linux kernel's USB MIDI gadget functionality. The issue arises during the cleanup of an endpoint not properly initialized, leading to a system crash when attempting to stop uninitialized endpoints. When the block direction for the MIDI 2.0 gadget is configured incorrectly, the initialization for certain endpoints is skipped, causing a dereference of a NULL pointer during operation. This vulnerability emphasizes the importance of proper endpoint initialization to maintain system stability.

References