CVE-2026-31759

usb: ulpi: fix double free in ulpi_register_interface() error path

State: Published
Severity: Not scored
Published: May 1, 2026
Updated: May 11, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: ulpi: fix double free in ulpi_register_interface() error path

When device_register() fails, ulpi_register() calls put_device() on ulpi->dev.

The device release callback ulpi_dev_release() drops the OF node reference and frees ulpi, but the current error path in ulpi_register_interface() then calls kfree(ulpi) again, causing a double free.

Let put_device() handle the cleanup through ulpi_dev_release() and avoid freeing ulpi again in ulpi_register_interface().

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before 2f70ba9dae13a190673cc3f9b4aad52179738f60Affected 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before ee248e6e941e4f2e634df2bd43e5f1ef810ab6dfAffected 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before 272a9b26c336a295e4e209157fed809706c1b1f7Affected 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before aaeae6533d77e6ed4def85baec01e2815ebbef61Affected 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before 8763f8317bb389aded32a32b08f6751cfff657d2Affected 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before 38c28fe25611099230f0965c925499bfcf46a795Affected 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before a6e5461f076c2ef63159f18e5cdbd30b50f0bc15Affected 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before 01af542392b5d41fd659d487015a71f627accce3Affected
LinuxLinux	4.2Affected before 4.2Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.168 through 6.1.Not affected 6.6.134 through 6.6.Not affected 6.12.81 through 6.12.Not affected 6.18.22 through 6.18.Not affected 6.19.12 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before 2f70ba9dae13a190673cc3f9b4aad52179738f60Affected
289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before ee248e6e941e4f2e634df2bd43e5f1ef810ab6dfAffected
289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before 272a9b26c336a295e4e209157fed809706c1b1f7Affected
289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before aaeae6533d77e6ed4def85baec01e2815ebbef61Affected
289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before 8763f8317bb389aded32a32b08f6751cfff657d2Affected
289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before 38c28fe25611099230f0965c925499bfcf46a795Affected
289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before a6e5461f076c2ef63159f18e5cdbd30b50f0bc15Affected
289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before 01af542392b5d41fd659d487015a71f627accce3Affected

LinuxLinux

4.2Affected
before 4.2Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.168 through 6.1.*Not affected
6.6.134 through 6.6.*Not affected
6.12.81 through 6.12.*Not affected
6.18.22 through 6.18.*Not affected
6.19.12 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.