---
id: CVE-2026-64332
title: 'USB: ulpi: fix memory leak on registration failure'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  USB: ulpi: fix memory leak on registration failure

  The allocated device name is never freed on early ULPI device
  registration failures.

  Fix this by initialising the d…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f <
    d5b32f36c50894ac2df8fa184e6f35f3a6665ecd
  - >-
    Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f <
    691e61e5d4cfc5a1b061e937f8cbf2126bfc19a0
  - >-
    Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f <
    88187a43135c79d0e43573b4d8f880bbb919eceb
  - >-
    Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f <
    5c098f20f15db7f9126129686d1c6da2ce8bbeb0
  - >-
    Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f <
    624c57147df1977e0d3da53f1da7117861b9cf19
  - >-
    Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f <
    1967a7f0cd5c08eb479196daa5aaa4b7b7a7bd04
  - >-
    Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f <
    e5493c9a98ffe083acf13ac064828ae598ba3c16
  - >-
    Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f <
    8af6812795869a66e9b26044f455b13deecdb69c
  - Linux 4.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:35:26.409197Z'
published: '2026-07-25'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:44:46.175Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64332'
references:
  - url: 'https://git.kernel.org/stable/c/d5b32f36c50894ac2df8fa184e6f35f3a6665ecd'
  - url: 'https://git.kernel.org/stable/c/691e61e5d4cfc5a1b061e937f8cbf2126bfc19a0'
  - url: 'https://git.kernel.org/stable/c/88187a43135c79d0e43573b4d8f880bbb919eceb'
  - url: 'https://git.kernel.org/stable/c/5c098f20f15db7f9126129686d1c6da2ce8bbeb0'
  - url: 'https://git.kernel.org/stable/c/624c57147df1977e0d3da53f1da7117861b9cf19'
  - url: 'https://git.kernel.org/stable/c/1967a7f0cd5c08eb479196daa5aaa4b7b7a7bd04'
  - url: 'https://git.kernel.org/stable/c/e5493c9a98ffe083acf13ac064828ae598ba3c16'
  - url: 'https://git.kernel.org/stable/c/8af6812795869a66e9b26044f455b13deecdb69c'
tags:
  - cve.org
epss: 0.00123
epssPercentile: 0.02029
ingestedAt: '2026-11-06T16:57:43.199Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

USB: ulpi: fix memory leak on registration failure

The allocated device name is never freed on early ULPI device
registration failures.

Fix this by initialising the device structure earlier and releasing the
initial reference whenever registration fails.

## Affected

- `Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f < d5b32f36c50894ac2df8fa184e6f35f3a6665ecd`
- `Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f < 691e61e5d4cfc5a1b061e937f8cbf2126bfc19a0`
- `Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f < 88187a43135c79d0e43573b4d8f880bbb919eceb`
- `Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f < 5c098f20f15db7f9126129686d1c6da2ce8bbeb0`
- `Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f < 624c57147df1977e0d3da53f1da7117861b9cf19`
- `Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f < 1967a7f0cd5c08eb479196daa5aaa4b7b7a7bd04`
- `Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f < e5493c9a98ffe083acf13ac064828ae598ba3c16`
- `Linux >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f < 8af6812795869a66e9b26044f455b13deecdb69c`
- `Linux 4.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.