CVE-2026-89735

What it actually does

The flaw is a reference count leak in the Linux kernel USB gadget MIDI2 driver: f_midi2_alloc_inst() adds default configfs groups (incrementing refcounts on f_midi2_ep_opts and f_midi2_block_opts) but f_midi2_free_inst() and f_midi2_ep_opts_release() omit the matching configfs_remove_default_groups() calls, leaving the structures permanently allocated.

Why it matters to the business

Repeated creation and teardown of MIDI2 USB gadget functions slowly exhausts kernel memory on affected Linux systems, potentially leading to degraded performance, failed device enumeration, or eventual denial of service after prolonged operation; low exploitability and absence from known campaigns reduce immediate urgency.

How an attack unfolds

An attacker with the ability to repeatedly load and unload the MIDI2 gadget function (for example via configfs on a system exposing USB gadget interfaces) triggers the allocation path without the corresponding cleanup, accumulating leaked kernel objects until memory pressure occurs.

How to fix it

Update to a Linux kernel version that includes the fix adding configfs_remove_default_groups() calls inside f_midi2_free_inst() and f_midi2_ep_opts_release(); rebuild and reboot with the corrected kernel; if immediate patching is not possible, avoid exposing MIDI2 gadget functions on untrusted systems.

How to confirm the fix worked

Confirm the presence of configfs_remove_default_groups() in both teardown functions in the kernel source; monitor kernel memory statistics (e.g., slabinfo for f_midi2_* objects) across repeated gadget create/destroy cycles to verify leak cessation.

Typical attack path

1. Obtain local or gadget-context access to a Linux system exposing USB gadget configfs
2. Create and configure a MIDI2 function instance via configfs
3. Trigger teardown of the instance or endpoint options (unbind, module unload, or EP release)
4. Repeat the allocate/teardown cycle to accumulate leaked objects

How to detect it

Search kernel logs and slab accounting for repeated allocations of f_midi2_ep_opts or f_midi2_block_opts without corresponding frees; monitor configfs teardown paths in f_midi2_free_inst and f_midi2_ep_opts_release for missing cleanup calls; no public exploitation artifacts are known.

What your security team should do

• Prioritize kernel updates on any systems using USB gadget MIDI2 functionality
• Audit configfs-exposed USB gadget configurations and restrict access where MIDI2 is unnecessary
• Add kernel memory leak monitoring for f_midi2 structs to existing observability tooling