CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path
In the Linux kernel, the following vulnerability has been resolved:
usb: ulpi: fix double free in ulpiregisterinterface() error path
When deviceregister() fails, ulpiregister() calls putdevice() on ulpi->dev.
The device release callback ulpidevrelease() drops the OF node reference and frees ulpi, but the current error path in ulpiregisterinterface() then calls kfree(ulpi) again, causing a double free.
Let putdevice() handle the cleanup through ulpidevrelease() and avoid freeing ulpi again in ulpiregisterinterface().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What condition triggers the double free?
The flaw is triggered when device_register() fails during ULPI interface registration. ulpi_register() then calls put_device(), whose release callback frees the ULPI object, while the error path subsequently calls kfree() on the same object.
What access does an attacker need to exploit this issue?
The supplied vector indicates local access, low attack complexity, low privileges, and no user interaction. The available data does not specify a particular interface or action an attacker uses to cause device_register() to fail.
What is the impact if the vulnerable error path is reached?
This is a double-free condition with high confidentiality, integrity, and availability impact in the supplied severity vector. It can affect the Linux kernel and Debian's linux package.
What does the fix change?
The fix removes the extra kfree() from the ulpi_register_interface() error path. Cleanup is left to put_device() and the ulpi_dev_release() callback, which already releases the OF node reference and frees the ULPI object.