CVE-2026-74502
In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: fix double free of out_cvts on rawmidi error snd_ump_attach_legacy_rawmidi() allocates the legacy conversion array ump->out_cvts and, on the snd_rawmidi_new() error path, frees it with kfree() but leaves ump->out_cvts pointing at the freed memory. When the endpoint is later torn down, snd_ump_endpoint_free() frees ump->out_cvts a second time, resulting in a double free. The host snd-usb-audio driver attaches the legacy rawmidi for any USB MIDI 2.0 (UMP) device, so a device that makes snd_rawmidi_new() fail reaches this path on enumeration. Clear ump->out_cvts after freeing it on the error path so it is not freed again during teardown. Discovered by XBOW, triaged by Baul Lee <[email protected]>
Affected versions
Linux kernel versions
6.5
and later are affected. Fixed in
6.6.151,
6.12.103,
6.18.44,
7.1.8,
7.2-rc6
and their respective stable series.
References
5 totalFrequently asked questions
-
What is CVE-2026-74502?
CVE-2026-74502 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.5 onward and has been patched in 6.6.151, 6.12.103, 6.18.44 and others. CVE-2026-74502 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-74502?
Yes. CVE-2026-74502 has been patched. Fixed versions include 6.6.151, 6.12.103, 6.18.44 and others. If you are running Linux kernel 6.5 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-74502 actively exploited?
No. CVE-2026-74502 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.