In the Linux kernel, the following vulnerability has been resolved: USB: ulpi: fix memory leak on registration failure The allocated device name is… (CVE-2026-64332)
Source GCVE Database
No CVSS score published yet
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 1% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
A fix for this vulnerability has been implemented in the Linux kernel. Since no specific patch links or affected versions are provided, users should apply the latest kernel updates from their Linux distribution vendors to ensure this issue is resolved.
Description
In the Linux kernel, the following vulnerability has been resolved: USB: ulpi: fix memory leak on registration failure The allocated device name is never freed on early ULPI device registration failures. Fix this by initialising the device structure earlier and releasing the initial reference whenever registration fails.
Impact
The vulnerability causes a memory leak in the kernel during ULPI device registration failures. While this does not directly lead to code execution or privilege escalation, it could potentially degrade system stability or availability over time if triggered repeatedly.
Summary
CVE-2026-64332 addresses a memory leak in the Linux kernel's USB ULPI driver. Specifically, when early ULPI device registration fails, the allocated device name was not freed, causing a memory leak. The resolution involved changing the initialization sequence of the device structure and ensuring that the initial reference is released upon registration failure.
References
- nvd.nist.gov/vuln/detail/CVE-2026-64332 (opens in a new tab)
- git.kernel.org/stable/c/1967a7f0cd5c08eb479196daa5aaa4b7b7a7bd04 (opens in a new tab)
- git.kernel.org/stable/c/5c098f20f15db7f9126129686d1c6da2ce8bbeb0 (opens in a new tab)
- git.kernel.org/stable/c/624c57147df1977e0d3da53f1da7117861b9cf19 (opens in a new tab)
- git.kernel.org/stable/c/691e61e5d4cfc5a1b061e937f8cbf2126bfc19a0 (opens in a new tab)
- git.kernel.org/stable/c/88187a43135c79d0e43573b4d8f880bbb919eceb (opens in a new tab)
- git.kernel.org/stable/c/8af6812795869a66e9b26044f455b13deecdb69c (opens in a new tab)
- git.kernel.org/stable/c/d5b32f36c50894ac2df8fa184e6f35f3a6665ecd (opens in a new tab)
- git.kernel.org/stable/c/e5493c9a98ffe083acf13ac064828ae598ba3c16 (opens in a new tab)