Executive brief
A vulnerability in the Linux kernel's USB subsystem could allow a local user to cause a memory leak. This occurs when certain USB hardware components (ULPI devices) fail to register correctly with the system. Over time, repeated registration failures could consume system memory, potentially leading to reduced performance or system instability.
Technical details
A memory leak exists in drivers/usb/common/ulpi.c within the Linux kernel. The vulnerability is caused by the failure to free an allocated device name when an early ULPI (UTMI+ Low Pin Interface) device registration fails. Specifically, the code did not properly release the initial device reference or free the allocated memory for the device name during error paths in ulpi_register(). An attacker with local access could potentially trigger this leak to exhaust system memory. The fix involves initializing the device structure earlier and ensuring put_device() is called to release the reference upon registration failure.
Affected products
- Linux Linux 4.2 to 5.10.261, 5.15.212, 6.1.178, 6.6.145
Timeline
- 2026-06-08: patched: Initial patch authored by Johan Hovold
- 2026-07-25: disclosed: CVE published by kernel.org
References
- https://git.kernel.org/stable/c/1967a7f0cd5c08eb479196daa5aaa4b7b7a7bd04
- https://git.kernel.org/stable/c/5c098f20f15db7f9126129686d1c6da2ce8bbeb0
- https://git.kernel.org/stable/c/624c57147df1977e0d3da53f1da7117861b9cf19
- https://git.kernel.org/stable/c/691e61e5d4cfc5a1b061e937f8cbf2126bfc19a0
- https://git.kernel.org/stable/c/88187a43135c79d0e43573b4d8f880bbb919eceb
- https://git.kernel.org/stable/c/8af6812795869a66e9b26044f455b13deecdb69c
- https://git.kernel.org/stable/c/d5b32f36c50894ac2df8fa184e6f35f3a6665ecd