CVE-2026-64332

USB: ulpi: fix memory leak on registration failure

State: Published
Severity: Not scored
Published: Jul 25, 2026
Updated: Aug 17, 2026
Reserved: Jul 19, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

USB: ulpi: fix memory leak on registration failure

The allocated device name is never freed on early ULPI device registration failures.

Fix this by initialising the device structure earlier and releasing the initial reference whenever registration fails.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before d5b32f36c50894ac2df8fa184e6f35f3a6665ecdAffected 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before 691e61e5d4cfc5a1b061e937f8cbf2126bfc19a0Affected 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before 88187a43135c79d0e43573b4d8f880bbb919ecebAffected 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before 5c098f20f15db7f9126129686d1c6da2ce8bbeb0Affected 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before 624c57147df1977e0d3da53f1da7117861b9cf19Affected 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before 1967a7f0cd5c08eb479196daa5aaa4b7b7a7bd04Affected 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before e5493c9a98ffe083acf13ac064828ae598ba3c16Affected 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before 8af6812795869a66e9b26044f455b13deecdb69cAffected
LinuxLinux	4.2Affected before 4.2Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.96 through 6.12.Not affected 6.18.39 through 6.18.Not affected 7.1.4 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before d5b32f36c50894ac2df8fa184e6f35f3a6665ecdAffected
289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before 691e61e5d4cfc5a1b061e937f8cbf2126bfc19a0Affected
289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before 88187a43135c79d0e43573b4d8f880bbb919ecebAffected
289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before 5c098f20f15db7f9126129686d1c6da2ce8bbeb0Affected
289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before 624c57147df1977e0d3da53f1da7117861b9cf19Affected
289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before 1967a7f0cd5c08eb479196daa5aaa4b7b7a7bd04Affected
289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before e5493c9a98ffe083acf13ac064828ae598ba3c16Affected
289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f to before 8af6812795869a66e9b26044f455b13deecdb69cAffected

LinuxLinux

4.2Affected
before 4.2Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.96 through 6.12.*Not affected
6.18.39 through 6.18.*Not affected
7.1.4 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.