---
id: CVE-2026-31759
title: 'usb: ulpi: fix double free in ulpi_register_interface() error path'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  usb: ulpi: fix double free in ulpi_register_interface() error path

  When device_register() fails, ulpi_register() calls put_device() on
  ulpi->dev.

  The device release c…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f <
    2f70ba9dae13a190673cc3f9b4aad52179738f60
  - >-
    Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f <
    ee248e6e941e4f2e634df2bd43e5f1ef810ab6df
  - >-
    Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f <
    272a9b26c336a295e4e209157fed809706c1b1f7
  - >-
    Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f <
    aaeae6533d77e6ed4def85baec01e2815ebbef61
  - >-
    Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f <
    8763f8317bb389aded32a32b08f6751cfff657d2
  - >-
    Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f <
    38c28fe25611099230f0965c925499bfcf46a795
  - >-
    Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f <
    a6e5461f076c2ef63159f18e5cdbd30b50f0bc15
  - >-
    Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f <
    01af542392b5d41fd659d487015a71f627accce3
  - Linux 4.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:24:54.410524Z'
published: '2026-05-01'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:32:24.202Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-31759'
references:
  - url: 'https://git.kernel.org/stable/c/2f70ba9dae13a190673cc3f9b4aad52179738f60'
  - url: 'https://git.kernel.org/stable/c/ee248e6e941e4f2e634df2bd43e5f1ef810ab6df'
  - url: 'https://git.kernel.org/stable/c/272a9b26c336a295e4e209157fed809706c1b1f7'
  - url: 'https://git.kernel.org/stable/c/aaeae6533d77e6ed4def85baec01e2815ebbef61'
  - url: 'https://git.kernel.org/stable/c/8763f8317bb389aded32a32b08f6751cfff657d2'
  - url: 'https://git.kernel.org/stable/c/38c28fe25611099230f0965c925499bfcf46a795'
  - url: 'https://git.kernel.org/stable/c/a6e5461f076c2ef63159f18e5cdbd30b50f0bc15'
  - url: 'https://git.kernel.org/stable/c/01af542392b5d41fd659d487015a71f627accce3'
tags:
  - cve.org
epss: 0.00129
epssPercentile: 0.02592
ingestedAt: '2026-11-06T15:54:04.050Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

usb: ulpi: fix double free in ulpi_register_interface() error path

When device_register() fails, ulpi_register() calls put_device() on
ulpi->dev.

The device release callback ulpi_dev_release() drops the OF node
reference and frees ulpi, but the current error path in
ulpi_register_interface() then calls kfree(ulpi) again, causing a
double free.

Let put_device() handle the cleanup through ulpi_dev_release() and
avoid freeing ulpi again in ulpi_register_interface().

## Affected

- `Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f < 2f70ba9dae13a190673cc3f9b4aad52179738f60`
- `Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f < ee248e6e941e4f2e634df2bd43e5f1ef810ab6df`
- `Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f < 272a9b26c336a295e4e209157fed809706c1b1f7`
- `Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f < aaeae6533d77e6ed4def85baec01e2815ebbef61`
- `Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f < 8763f8317bb389aded32a32b08f6751cfff657d2`
- `Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f < 38c28fe25611099230f0965c925499bfcf46a795`
- `Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f < a6e5461f076c2ef63159f18e5cdbd30b50f0bc15`
- `Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f < 01af542392b5d41fd659d487015a71f627accce3`
- `Linux 4.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.