CVE-2018-20961: Linux Kernel

Critical severity, CVSS 9.8. EPSS: 6.3% chance of exploitation in the next 30 days.

In the Linux kernel before 4.16.4, a double free vulnerability in the f_midi_set_alt function of drivers/usb/gadget/function/f_midi.c in the f_midi driver may allow attackers to cause a denial of service or possibly have unspecified other impact.

Affected products

• Linux Linux Kernel: from 4.4, before 4.4.190 (fixed in 4.4.190); from 4.5, before 4.9.96 (fixed in 4.9.96); from 4.10, before 4.14.36 (fixed in 4.14.36); from 4.15.0, before 4.16.4 (fixed in 4.16.4)

Published 2019-08-07. Last modified 2026-06-17.