{"id":"CVE-2026-89735","summary":"usb: gadget: midi2: remove default configfs groups on teardown","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: midi2: remove default configfs groups on teardown\n\nf_midi2_alloc_inst() creates default configfs child groups for the\ndefault endpoint and default block using configfs_add_default_group(),\nsetting their internal refcount to 1.\n\nHowever, during function teardown in f_midi2_free_inst() or EP cleanup\nin f_midi2_ep_opts_release(), configfs_remove_default_groups() is\nnever called, therefore never dropping the refcount and leaking struct\nf_midi2_ep_opts and f_midi2_block_opts.\n\nAdd the missing configfs_remove_default_groups() in the afformentioned\nfunctions to free the structs properly.","modified":"2026-09-15T03:48:21.643486688Z","published":"2026-09-11T19:46:43.899Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89735.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0f6bffb5008f0cba9cad5ded2caccc64466a6e54"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4beda67ee72e0c8df5b49951dd8b96f6adb25e02"},{"type":"WEB","url":"https://git.kernel.org/stable/c/79dbedf40ad930f83839e564394dc5d1a54938c6"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9ea5dfb2bfef4f8a7e704d1921d8a790cb7fb700"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a15c2acd3083461f91725760e59dff88b33c28f6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89735.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89735"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"8b645922b22303cec4628dbbbf6c8553d1cdec87"},{"fixed":"79dbedf40ad930f83839e564394dc5d1a54938c6"},{"fixed":"4beda67ee72e0c8df5b49951dd8b96f6adb25e02"},{"fixed":"a15c2acd3083461f91725760e59dff88b33c28f6"},{"fixed":"9ea5dfb2bfef4f8a7e704d1921d8a790cb7fb700"},{"fixed":"0f6bffb5008f0cba9cad5ded2caccc64466a6e54"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89735.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6.0"},{"fixed":"6.6.157"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.109"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.50"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89735.json"}}],"schema_version":"1.9.0"}