PT-2026-44232 · Linux · Linux

Published 2026-05-28 · Updated 2026-05-28 · CVE-2026-46109

Mitre

In the Linux kernel, the following vulnerability has been resolved:

usb: ulpi: fix memory leak on ulpi register() error paths

Commit 01af542392b5 ("usb: ulpi: fix double free in ulpi register interface() error path") removed kfree(ulpi) from ulpi register interface() to fix a double-free when device register() fails.

But when ulpi of register() or ulpi read id() fail before device register() is called, the ulpi allocation is leaked.

Add kfree(ulpi) on both error paths to properly clean up the allocation.

Related Identifiers

CVE-2026-46109

Affected Products

Linux

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-46109 · Security Note
• https://git.kernel.org/stable/c/b0c0d44adb55c66663886cb6e30ee92cbb0f5385 · Note
• https://git.kernel.org/stable/c/2a71e01b2cf9b4329ff67102c1bea7448c2a2d2d · Note
• https://git.kernel.org/stable/c/be2c1d825f54277472c87019e82013ac534ddc4c · Note
• https://git.kernel.org/stable/c/f30ccfc2985590b33a23a3d8bed7ca16c0af551b · Note
• https://git.kernel.org/stable/c/0b9fcab1b8608d429e5f239afb197de928d4de7d · Note