CVE-2026-90024

Kernel crash via uninitialized MIDI endpoint cleanup

Published Sep 16, 2026 · Updated Sep 16, 2026

Null-pointer dereference in Linux MIDI 2.0 gadget code allows physically proximate attackers to crash the kernel over USB. The f_midi2_set_alt function stops both endpoints, and f_midi2_free_ep_reqs reads usb_ep->card for an input-only endpoint whose initialization was skipped, dereferencing NULL. Exploitation requires a configured MIDI 2.0 gadget with an input-only function block and a connected host that selects the alternate setting; the bounded consequence is a kernel crash.

CVSS severityUnavailable
Unscored
EPSS probabilityUnavailable
No score available in this record
Known exploitationUnconfirmed
Based on sourced intelligence
Hinoki checkNot available
Coverage for this vulnerability

See if you're affected

Explore vulnerability checks for your environment with Hinoki.

Book a demo

Summary

What happened

Null-pointer dereference in Linux MIDI 2.0 gadget code allows physically proximate attackers to crash the kernel over USB. The f_midi2_set_alt function stops both endpoints, and f_midi2_free_ep_reqs reads usb_ep->card for an input-only endpoint whose initialization was skipped, dereferencing NULL. Exploitation requires a configured MIDI 2.0 gadget with an input-only function block and a connected host that selects the alternate setting; the bounded consequence is a kernel crash.

The record

CVE
CVE-2026-90024
Published
Sep 16, 2026
Updated
Sep 16, 2026
Vendor
The Linux Kernel Organization
Product
Linux
Classifications
T1499.004
Attack vector
physical
Privileges
unauthenticated

Timeline

How it unfolded

  1. Sep 16, 2026CVE publishedPublication date reported by the CVE source.
  2. Sep 16, 2026Record updatedLatest update available in the CVE record.

Exploitability

Present is not the same as exploitable

Compare your product and version with the public record. A matching version still requires validation against your environment.

Is a vulnerable build present?

Compare these published version ranges with your installed build and any vendor patches.

  1. Affected versionversion=6.6
  2. Affected versionversion=8b645922b22303cec4628dbbbf6c8553d1cdec87 <4079f19a0e1ce76f1e21a398f02aca150ceaaf61
  3. Affected versionversion=8b645922b22303cec4628dbbbf6c8553d1cdec87 <51ddc55c75087ac25342f6d73d3aeaf14f59bd76
  4. Affected versionversion=8b645922b22303cec4628dbbbf6c8553d1cdec87 <5b92f6a0c7c01efbb335d837ecdf34d38d98720f
  5. Affected versionversion=8b645922b22303cec4628dbbbf6c8553d1cdec87 <9c3d5091e3568ed48ac4c5b08a78eb06fad0d70a
  6. Affected versionversion=8b645922b22303cec4628dbbbf6c8553d1cdec87 <f0efaf1872949e96d213c8e910fd9517f7d7c406

What conditions does exploitation require?

Attack vectorphysical
Required privilegesunauthenticated

What is affected?

The Linux Kernel Organization · Linuxversion=6.6; version=8b645922b22303cec4628dbbbf6c8553d1cdec87 <4079f19a0e1ce76f1e21a398f02aca150ceaaf61; version=8b645922b22303cec4628dbbbf6c8553d1cdec87 <51ddc55c75087ac25342f6d73d3aeaf14f59bd76; version=8b645922b22303cec4628dbbbf6c8553d1cdec87 <5b92f6a0c7c01efbb335d837ecdf34d38d98720f; version=8b645922b22303cec4628dbbbf6c8553d1cdec87 <9c3d5091e3568ed48ac4c5b08a78eb06fad0d70a; version=8b645922b22303cec4628dbbbf6c8553d1cdec87 <f0efaf1872949e96d213c8e910fd9517f7d7c406

Published CVSS scores

No CVSS assessment is available in this record.

CVSS describes severity. EPSS estimates exploitation probability.

Attacks

What attackers are doing with it

Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.

Daily unique IPsNo honeypot observations are available for this CVE in the selected window.

No observations available

Sep 10, 2026Sep 16, 2026
Latest reporting daySep 16, 2026
Latest daily unique IPsUnavailable
Prior 30-day averageUnavailable
SourceShadowserver honeypots (KEV)
Vectorphysical
Privilegesunauthenticated
Known exploitationUnconfirmed
Public exploitUnconfirmed

Weakness, pattern, technique

T1499.004Application or System Exploitation

Public exploit references

No public exploit references are available in this record.

Labels summarize the accepted research assessment. They do not indicate a test against your environment.

Technologies

Your stack

See the directory against your own environment.

Your stack

Check the software in your environment

Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.

Book a demo