Linux Kernel USB Audio MIDI Substream Work Cancellation Vulnerability

A vulnerability in the Linux kernel's USB audio subsystem for MIDI handling has been addressed. When closing a USB MIDI output substream, there could be pending work that remains, potentially accessing the raw MIDI runtime object that is in the process of being released. This issue created a race condition. The vulnerability has been fixed by ensuring that any pending work is canceled before closing the substream.

Impact

Exploitation of this vulnerability could lead to a race condition, where pending work accesses a runtime object that is being released, potentially causing undefined behavior.