CVE-2026-72443: In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing
Summary
A Linux kernel bug in MIDI 2.0 audio processing caused a use-after-free vulnerability (accessing memory that has already been freed) when URBs (USB request blocks, which are data transfers over USB) were not properly stopped before their memory was released during setup failures. This could lead to system crashes when the USB completion handler tried to access freed memory.
Solution / Mitigation
Make the endpoint destructor follow the same teardown ordering used during disconnect: publish the endpoint's disconnected status, kill the URBs synchronously (stop them and wait for completion), and drain the endpoint before freeing URB buffers and endpoint storage. A guard prevents repeating this stop sequence after the normal disconnect path, while still synchronizing the direct MIDI 2.0 create-error free path.
Vulnerability Details
EPSS: 0.0%
August 15, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-72443
First tracked: August 15, 2026 at 08:08 AM
Classified by LLM (prompt v3) · confidence: 95%