CVE-2026-64332: USB: ulpi: fix memory leak on registration failure
In the Linux kernel, the following vulnerability has been resolved:
USB: ulpi: fix memory leak on registration failure
The allocated device name is never freed on early ULPI device registration failures.
Fix this by initialising the device structure earlier and releasing the initial reference whenever registration fails.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.145.2-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64332?
The severity of CVE-2026-64332 is classified as medium with a score of 5.5.
What are the potential impacts of CVE-2026-64332?
CVE-2026-64332 can lead to a memory leak due to an unfreed allocated device name on registration failures.
How do I fix CVE-2026-64332?
To fix CVE-2026-64332, update your Linux kernel to a version where the memory leak issue has been addressed.
Which software is affected by CVE-2026-64332?
CVE-2026-64332 affects the Linux Kernel and specifically the Microsoft azl3 kernel version 6.6.144.1-1.
When was CVE-2026-64332 published?
CVE-2026-64332 was published on July 25, 2026.