CVE-2026-31759 Details
Description
In the Linux kernel, the following vulnerability has been resolved: usb: ulpi: fix double free in ulpi_register_interface() error path When device_register() fails, ulpi_register() calls put_device() on ulpi->dev. The device release callback ulpi_dev_release() drops the OF node reference and frees ulpi, but the current error path in ulpi_register_interface() then calls kfree(ulpi) again, causing a double free. Let put_device() handle the cleanup through ulpi_dev_release() and avoid freeing ulpi again in ulpi_register_interface().
A double free vulnerability has been identified in the USB ULPI (Universal Land Interface) driver of the Linux kernel. This issue arises in the 'ulpi_register_interface()' function when 'device_register()' fails. The 'ulpi_register()' function then calls 'put_device()' on 'ulpi->dev', triggering the device release callback 'ulpi_dev_release()', which drops the OF node reference and frees 'ulpi'. However, the current error handling in 'ulpi_register_interface()' calls 'kfree(ulpi)' again, leading to a double free situation. The vulnerability affects the Linux kernel stable tree.
The vulnerability has been fixed in the Linux kernel. Users should upgrade to the latest version.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/01af542392b5d41fd659d487015a71f627accce3 | kernel.org | Patch |
| https://git.kernel.org/stable/c/272a9b26c336a295e4e209157fed809706c1b1f7 | kernel.org | Patch |
| https://git.kernel.org/stable/c/2f70ba9dae13a190673cc3f9b4aad52179738f60 | kernel.org | Patch |
| https://git.kernel.org/stable/c/38c28fe25611099230f0965c925499bfcf46a795 | kernel.org | Patch |
| https://git.kernel.org/stable/c/8763f8317bb389aded32a32b08f6751cfff657d2 | kernel.org | Patch |
| https://git.kernel.org/stable/c/a6e5461f076c2ef63159f18e5cdbd30b50f0bc15 | kernel.org | Patch |
| https://git.kernel.org/stable/c/aaeae6533d77e6ed4def85baec01e2815ebbef61 | kernel.org | Patch |
| https://git.kernel.org/stable/c/ee248e6e941e4f2e634df2bd43e5f1ef810ab6df | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-415 | Double Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.2, < 5.10.253 >= 5.11, < 5.15.203 >= 5.16, < 6.1.168 >= 6.2, < 6.6.134 >= 6.7, < 6.12.81 >= 6.13, < 6.18.22 >= 6.19, < 6.19.12 7.0 rc1 7.0 rc2 7.0 rc3 7.0 rc4 7.0 rc5 7.0 rc6 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 8, 2026 | Initial Analysis | [email protected] |
| May 1, 2026 | New CVE Received | kernel.org |