CVE-2026-74502

In the Linux kernel, the following vulnerability has been resolved:

ALSA: ump: fix double free of out_cvts on rawmidi error

sndumpattachlegacyrawmidi() allocates the legacy conversion array ump->outcvts and, on the sndrawmidinew() error path, frees it with kfree() but leaves ump->outcvts pointing at the freed memory. When the endpoint is later torn down, sndumpendpointfree() frees ump->outcvts a second time, resulting in a double free.

The host snd-usb-audio driver attaches the legacy rawmidi for any USB MIDI 2.0 (UMP) device, so a device that makes sndrawmidinew() fail reaches this path on enumeration.

Clear ump->out_cvts after freeing it on the error path so it is not freed again during teardown.

Discovered by XBOW, triaged by Baul Lee baul.lee@xbow.com