CVE-2026-64332 - Vulnerability Details

- USB: ulpi: fix memory leak on registration failure

Description

In the Linux kernel, the following vulnerability has been resolved:

USB: ulpi: fix memory leak on registration failure

The allocated device name is never freed on early ULPI device
registration failures.

Fix this by initialising the device structure earlier and releasing the
initial reference whenever registration fails.

Published: 2026-07-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f`	affected	< d5b32f36c50894ac2df8fa184e6f35f3a6665ecd
`289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f`	affected	< 691e61e5d4cfc5a1b061e937f8cbf2126bfc19a0
`289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f`	affected	< 88187a43135c79d0e43573b4d8f880bbb919eceb
`289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f`	affected	< 5c098f20f15db7f9126129686d1c6da2ce8bbeb0
`289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f`	affected	< 624c57147df1977e0d3da53f1da7117861b9cf19
`289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f`	affected	< 1967a7f0cd5c08eb479196daa5aaa4b7b7a7bd04
`289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f`	affected	< e5493c9a98ffe083acf13ac064828ae598ba3c16
`289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f`	affected	< 8af6812795869a66e9b26044f455b13deecdb69c

Linux

affected

Version	Status	Constraints
`4.2`	affected	—
`0`	unaffected	< 4.2
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f,d5b32f36c50894ac2df8fa184e6f35f3a6665ecd)`	affected	code_commit	—
`[289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f,691e61e5d4cfc5a1b061e937f8cbf2126bfc19a0)`	affected	code_commit	—
`[289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f,88187a43135c79d0e43573b4d8f880bbb919eceb)`	affected	code_commit	—
`[289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f,5c098f20f15db7f9126129686d1c6da2ce8bbeb0)`	affected	code_commit	—
`[289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f,624c57147df1977e0d3da53f1da7117861b9cf19)`	affected	code_commit	—
`[289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f,1967a7f0cd5c08eb479196daa5aaa4b7b7a7bd04)`	affected	code_commit	—
`[289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f,e5493c9a98ffe083acf13ac064828ae598ba3c16)`	affected	code_commit	—
`[289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f,8af6812795869a66e9b26044f455b13deecdb69c)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.2`	affected	generic	—
`[0,4.2)`	unaffected	generic	—
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[7.2-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00177.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1967a7f0cd5c08eb479196daa5aaa4b7b7a7bd04
https://git.kernel.org/stable/c/5c098f20f15db7f9126129686d1c6da2ce8bbeb0
https://git.kernel.org/stable/c/624c57147df1977e0d3da53f1da7117861b9cf19
https://git.kernel.org/stable/c/691e61e5d4cfc5a1b061e937f8cbf2126bfc19a0
https://git.kernel.org/stable/c/88187a43135c79d0e43573b4d8f880bbb919eceb
https://git.kernel.org/stable/c/8af6812795869a66e9b26044f455b13deecdb69c
https://git.kernel.org/stable/c/d5b32f36c50894ac2df8fa184e6f35f3a6665ecd
https://git.kernel.org/stable/c/e5493c9a98ffe083acf13ac064828ae598ba3c16
https://lore.kernel.org/linux-cve-announce/2026072514-CVE-2026-64332-f4af@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64332
https://www.cve.org/CVERecord?id=CVE-2026-64332

History

Thu, 30 Jul 2026 04:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-401

Wed, 29 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://lore.kernel.org/linux-cve-announce/2026072514-CVE-2026-64332-f4af@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64332 https://www.cve.org/CVERecord?id=CVE-2026-64332
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Tue, 28 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-401

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: USB: ulpi: fix memory leak on registration failure The allocated device name is never freed on early ULPI device registration failures. Fix this by initialising the device structure earlier and releasing the initial reference whenever registration fails.
Title		USB: ulpi: fix memory leak on registration failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1967a7f0cd5c08eb479196daa5aaa4b7b7a7bd04 https://git.kernel.org/stable/c/5c098f20f15db7f9126129686d1c6da2ce8bbeb0 https://git.kernel.org/stable/c/624c57147df1977e0d3da53f1da7117861b9cf19 https://git.kernel.org/stable/c/691e61e5d4cfc5a1b061e937f8cbf2126bfc19a0 https://git.kernel.org/stable/c/88187a43135c79d0e43573b4d8f880bbb919eceb https://git.kernel.org/stable/c/8af6812795869a66e9b26044f455b13deecdb69c https://git.kernel.org/stable/c/d5b32f36c50894ac2df8fa184e6f35f3a6665ecd https://git.kernel.org/stable/c/e5493c9a98ffe083acf13ac064828ae598ba3c16

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:49:59.005Z

Updated: 2026-07-25T08:49:59.005Z

Reserved: 2026-07-19T15:36:31.781Z

Link: CVE-2026-64332

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Low

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64332 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-30T04:00:05Z

Weaknesses

CWE-772
Missing Release of Resource after Effective Lifetime

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object