Bug 2464457 (CVE-2026-31759)

Summary:	CVE-2026-31759 kernel: usb: ulpi: fix double free in ulpi_register_interface() error path
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's USB ULPI (UTMI+ Low Pin Interface) driver. An error in the `ulpi_register_interface()` function's cleanup path can lead to a double free vulnerability. This occurs when `device_register()` fails, causing the `ulpi` structure to be freed twice. A local attacker could potentially exploit this to cause memory corruption or a denial of service, leading to system instability.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-05-01 15:07:52 UTC

In the Linux kernel, the following vulnerability has been resolved:

usb: ulpi: fix double free in ulpi_register_interface() error path

When device_register() fails, ulpi_register() calls put_device() on
ulpi->dev.

The device release callback ulpi_dev_release() drops the OF node
reference and frees ulpi, but the current error path in
ulpi_register_interface() then calls kfree(ulpi) again, causing a
double free.

Let put_device() handle the cleanup through ulpi_dev_release() and
avoid freeing ulpi again in ulpi_register_interface().

Comment 1 Keith Grant 2026-05-01 22:34:55 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026050145-CVE-2026-31759-426b@gregkh/T