CVE-2026-64332

In the Linux kernel, the following vulnerability has been resolved: USB: ulpi: fix memory leak on registration failure The allocated device name is never freed on early ULPI device registration failures. Fix this by initialising the device structure earlier and releasing the initial reference whenever registration fails.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/1967a7f0cd5c08eb479196daa5aaa4b7b7a7bd04	Patch
https://git.kernel.org/stable/c/5c098f20f15db7f9126129686d1c6da2ce8bbeb0	Patch
https://git.kernel.org/stable/c/624c57147df1977e0d3da53f1da7117861b9cf19	Patch
https://git.kernel.org/stable/c/691e61e5d4cfc5a1b061e937f8cbf2126bfc19a0	Patch
https://git.kernel.org/stable/c/88187a43135c79d0e43573b4d8f880bbb919eceb	Patch
https://git.kernel.org/stable/c/8af6812795869a66e9b26044f455b13deecdb69c	Patch
https://git.kernel.org/stable/c/d5b32f36c50894ac2df8fa184e6f35f3a6665ecd	Patch
https://git.kernel.org/stable/c/e5493c9a98ffe083acf13ac064828ae598ba3c16	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.2:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.2:rc2::::::

History

No history.

Information

Published : 2026-07-25 10:17

Updated : 2026-09-03 16:04

NVD link : CVE-2026-64332

Mitre link : CVE-2026-64332

CVE.ORG link : CVE-2026-64332

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-401

Missing Release of Memory after Effective Lifetime

{"id": "CVE-2026-64332", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f", "lessThan": "d5b32f36c50894ac2df8fa184e6f35f3a6665ecd", "versionType": "git"}, {"status": "affected", "version": "289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f", "lessThan": "691e61e5d4cfc5a1b061e937f8cbf2126bfc19a0", "versionType": "git"}, {"status": "affected", "version": "289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f", "lessThan": "88187a43135c79d0e43573b4d8f880bbb919eceb", "versionType": "git"}, {"status": "affected", "version": "289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f", "lessThan": "5c098f20f15db7f9126129686d1c6da2ce8bbeb0", "versionType": "git"}, {"status": "affected", "version": "289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f", "lessThan": "624c57147df1977e0d3da53f1da7117861b9cf19", "versionType": "git"}, {"status": "affected", "version": "289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f", "lessThan": "1967a7f0cd5c08eb479196daa5aaa4b7b7a7bd04", "versionType": "git"}, {"status": "affected", "version": "289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f", "lessThan": "e5493c9a98ffe083acf13ac064828ae598ba3c16", "versionType": "git"}, {"status": "affected", "version": "289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f", "lessThan": "8af6812795869a66e9b26044f455b13deecdb69c", "versionType": "git"}], "programFiles": ["drivers/usb/common/ulpi.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.2"}, {"status": "unaffected", "version": "0", "lessThan": "4.2", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.261", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.212", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.178", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.145", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.96", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.39", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.4", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/usb/common/ulpi.c"], "defaultStatus": "affected"}]}], "published": "2026-07-25T10:17:14.950", "references": [{"url": "https://git.kernel.org/stable/c/1967a7f0cd5c08eb479196daa5aaa4b7b7a7bd04", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5c098f20f15db7f9126129686d1c6da2ce8bbeb0", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/624c57147df1977e0d3da53f1da7117861b9cf19", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/691e61e5d4cfc5a1b061e937f8cbf2126bfc19a0", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/88187a43135c79d0e43573b4d8f880bbb919eceb", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/8af6812795869a66e9b26044f455b13deecdb69c", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d5b32f36c50894ac2df8fa184e6f35f3a6665ecd", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e5493c9a98ffe083acf13ac064828ae598ba3c16", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-401"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: ulpi: fix memory leak on registration failure\n\nThe allocated device name is never freed on early ULPI device\nregistration failures.\n\nFix this by initialising the device structure earlier and releasing the\ninitial reference whenever registration fails."}], "lastModified": "2026-09-03T16:04:34.633", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B621CF41-0682-4D1D-A39A-C8C108F2B377", "versionEndExcluding": "5.10.261", "versionStartIncluding": "4.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8E99FB01-CD93-41AF-A653-3F450652B9A6", "versionEndExcluding": "5.15.212", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "092233C7-F4E0-40C8-BD4D-A28FE50DFE20", "versionEndExcluding": "6.1.178", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7046B092-F810-4440-ACE6-60218518EECE", "versionEndExcluding": "6.6.145", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "38A8100E-2B1A-462F-AEE9-8901B870FEF2", "versionEndExcluding": "6.12.96", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7", "versionEndExcluding": "6.18.39", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42", "versionEndExcluding": "7.1.4", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5E8B9085-7ADB-4A05-89EF-12949B6A0509"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1FC0D50D-9D58-4947-A197-A5A3FF07E7E3"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}