CVE-2026-64332
Published: July 29, 2026Last modified: August 14, 2026
Description
In the Linux kernel, the following vulnerability has been resolved: USB: ulpi: fix memory leak on registration failure The allocated device name is never freed on early ULPI device registration failures. Fix this by initialising the device structure earlier and releasing the initial reference whenever registration fails.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 5.5 |
| Attack Vector | LOCAL |
| Attack complexity | LOW |
| Privileges required | LOW |
| User interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality | NONE |
| Integrity impact | NONE |
| Availability impact | HIGH |
| Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Status
| Product | Release | Package | Status |
|---|---|---|---|
| Alpaquita Linux | 23 LTS | linux-lts | Fixed (6.1.182-r0) |
| 25 LTS | linux-lts | Fixed (6.12.103-r0) | |
| Stream | linux-lts | Fixed (6.18.43-r0) |
References
- https://git.kernel.org/stable/c/1967a7f0cd5c08eb479196daa5aaa4b7b7a7bd04
- https://git.kernel.org/stable/c/5c098f20f15db7f9126129686d1c6da2ce8bbeb0
- https://git.kernel.org/stable/c/624c57147df1977e0d3da53f1da7117861b9cf19
- https://git.kernel.org/stable/c/691e61e5d4cfc5a1b061e937f8cbf2126bfc19a0
- https://git.kernel.org/stable/c/88187a43135c79d0e43573b4d8f880bbb919eceb
- https://git.kernel.org/stable/c/8af6812795869a66e9b26044f455b13deecdb69c
- https://git.kernel.org/stable/c/d5b32f36c50894ac2df8fa184e6f35f3a6665ecd
- https://git.kernel.org/stable/c/e5493c9a98ffe083acf13ac064828ae598ba3c16