Medium 5.5Published May 28, 2026

CVE-2026-46109usb: ulpi: fix memory leak on ulpi_register() error paths

Updated under an hour ago (Oct 28, 2026, 3:10 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: usb: ulpi: fix memory leak on ulpi_register() error paths Commit 01af542392b5 ("usb: ulpi: fix double free in ulpi_register_interface() error path") removed kfree(ulpi) from ulpi_register_interface() to fix a double-free when device_register() fails. But when ulpi_of_register() or ulpi_read_id() fail before device_register() is called, the ulpi allocation is leaked. Add kfree(ulpi) on both error paths to properly clean up the allocation.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Undergoing Analysis
Record last updated: Jun 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	2f70ba9dae13a190673cc3f9b4aad52179738f60 builds before 0c2c0c6820fe96fa4be0a0499f8d3f3321b9af6c; from ee248e6e941e4f2e634df2bd43e5f1ef810ab6df before f1b855c00988a9cb41134cab7cf9faedba775dd9; 272a9b26c336a295e4e209157fed809706c1b1f7 builds before 7bd61ed0bf9f4f1f2673d489b3bda1555b48d054; from aaeae6533d77e6ed4def85baec01e2815ebbef61 before b0c0d44adb55c66663886cb6e30ee92cbb0f5385; from 8763f8317bb389aded32a32b08f6751cfff657d2 before be2c1d825f54277472c87019e82013ac534ddc4c; 38c28fe25611099230f0965c925499bfcf46a795 builds before 2a71e01b2cf9b4329ff67102c1bea7448c2a2d2d; from 01af542392b5d41fd659d487015a71f627accce3 before f30ccfc2985590b33a23a3d8bed7ca16c0af551b; 01af542392b5d41fd659d487015a71f627accce3 builds before 0b9fcab1b8608d429e5f239afb197de928d4de7d; and 8 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 5.10.253 before 5.10.258; from 5.15.203 before 5.15.209; from 6.1.168 before 6.1.175; from 6.6.134 before 6.6.140; from 6.12.81 before 6.12.88; from 6.18.22 before 6.18.30; from 6.19.12 before 7.0; from 7.0.1 before 7.0.7; and 4 more ranges	NVD

References

References

https://git.kernel.org/stable/c/0c2c0c6820fe96fa4be0a0499f8d3f3321b9af6c	patch
https://git.kernel.org/stable/c/f1b855c00988a9cb41134cab7cf9faedba775dd9	patch
https://git.kernel.org/stable/c/7bd61ed0bf9f4f1f2673d489b3bda1555b48d054	patch
https://git.kernel.org/stable/c/b0c0d44adb55c66663886cb6e30ee92cbb0f5385	patch
https://git.kernel.org/stable/c/be2c1d825f54277472c87019e82013ac534ddc4c	patch
https://git.kernel.org/stable/c/2a71e01b2cf9b4329ff67102c1bea7448c2a2d2d	patch
https://git.kernel.org/stable/c/f30ccfc2985590b33a23a3d8bed7ca16c0af551b	patch
https://git.kernel.org/stable/c/0b9fcab1b8608d429e5f239afb197de928d4de7d	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.