CVE-2026-74502: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-rpcv-w828-3j36
Share
Published
Advisory Summary

CVE-2026-74502 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-74502 at a Glance

CVE Identifier CVE-2026-74502
GHSA Identifier GHSA-rpcv-w828-3j36
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-74502

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-74502, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: fix double free of out_cvts on rawmidi error snd_ump_attach_legacy_rawmidi() allocates the legacy conversion array ump->out_cvts and, on the snd_rawmidi_new() error path, frees it with kfree() but leaves ump->out_cvts pointing at the freed memory. When the endpoint is later torn down, snd_ump_endpoint_free() frees ump->out_cvts a second time, resulting in a double free. The host snd-usb-audio driver attaches the legacy rawmidi for any USB MIDI 2.0 (UMP) device, so a device that makes snd_rawmidi_new() fail reaches this path on enumeration. Clear ump->out_cvts after freeing it on the error path so it is not freed again during teardown. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>

References

NVD — CVE-2026-74502 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-74502
git.kernel.org/stable/c/032746c2dd... WEB
https://git.kernel.org/stable/c/032746c2dd9a4ea0774b04ac8a29e2ea628f106e
git.kernel.org/stable/c/3302aaeac4... WEB
https://git.kernel.org/stable/c/3302aaeac4f7ee6b775850db21d5f61064ce70ad
git.kernel.org/stable/c/70c977815a... WEB
https://git.kernel.org/stable/c/70c977815af0d997feb2d0c5d284d55689bf7051
git.kernel.org/stable/c/c57001f55f... WEB
https://git.kernel.org/stable/c/c57001f55f97ef856fb6527e376c5c4a056a53a4
git.kernel.org/stable/c/e84d2e53a0... WEB
https://git.kernel.org/stable/c/e84d2e53a05c78a04d1343eeb0f31a79456e79fc

Frequently Asked Questions

What is CVE-2026-74502?
CVE-2026-74502 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-74502?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-74502?
CVE-2026-74502 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-74502?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-rpcv-w828-3j36",
  "modified" : "2026-08-15T15:30:34Z",
  "published" : "2026-08-15T15:30:34Z",
  "aliases" : [ "CVE-2026-74502" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ump: fix double free of out_cvts on rawmidi error\n\nsnd_ump_attach_legacy_rawmidi() allocates the legacy conversion array\nump->out_cvts and, on the snd_rawmidi_new() error path, frees it with\nkfree() but leaves ump->out_cvts pointing at the freed memory.  When the\nendpoint is later torn down, snd_ump_endpoint_free() frees ump->out_cvts\na second time, resulting in a double free.\n\nThe host snd-usb-audio driver attaches the legacy rawmidi for any USB\nMIDI 2.0 (UMP) device, so a device that makes snd_rawmidi_new() fail\nreaches this path on enumeration.\n\nClear ump->out_cvts after freeing it on the error path so it is not\nfreed again during teardown.\n\nDiscovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-74502"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/032746c2dd9a4ea0774b04ac8a29e2ea628f106e"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3302aaeac4f7ee6b775850db21d5f61064ce70ad"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/70c977815af0d997feb2d0c5d284d55689bf7051"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c57001f55f97ef856fb6527e376c5c4a056a53a4"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/e84d2e53a05c78a04d1343eeb0f31a79456e79fc"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-15T13:17:55Z"
  }
}