🟡 Medium | Source: Microsoft Security Response Center
CVE-2026-64584 is a Linux kernel vulnerability affecting the USB MIDI gadget driver, where a pending work item is not cancelled before the MIDI object is freed, potentially leading to a use-after-free condition. While originating in the Linux kernel, this advisory is published via Microsoft’s Security Response Center in the context of Azure, likely affecting Linux-based Azure infrastructure or services. Use-after-free flaws can lead to memory corruption, system instability, or in worst cases, privilege escalation.
Security Architect’s Take: Review whether your Azure Linux VM images or AKS node pools are running kernel versions affected by this flaw and prioritise patching through your standard OS update pipeline; if you operate Azure infrastructure with USB passthrough or specialised kernel configurations, treat this with elevated urgency.
Original advisory: CVE-2026-64584 usb: gadget: f_midi: cancel pending IN work before freeing the midi object