CVE-2026-31759 in Linux
Summary
by MITRE • 05/01/2026
In the Linux kernel, the following vulnerability has been resolved:
usb: ulpi: fix double free in ulpi_register_interface() error path
When device_register() fails, ulpi_register() calls put_device() on ulpi->dev.
The device release callback ulpi_dev_release() drops the OF node reference and frees ulpi, but the current error path in ulpi_register_interface() then calls kfree(ulpi) again, causing a double free.
Let put_device() handle the cleanup through ulpi_dev_release() and avoid freeing ulpi again in ulpi_register_interface().
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/28/2026
This vulnerability exists in the linux kernel's usb subsystem specifically within the ulpi (universal serial bus low-power interface) driver implementation. The issue manifests as a double free condition that occurs during the error handling path of the ulpi_register_interface() function, representing a critical memory corruption flaw that could potentially be exploited by malicious actors. The vulnerability stems from improper resource management where the same memory block gets freed twice, creating a predictable crash condition that may allow privilege escalation or system instability.
The technical flaw occurs when device_register() fails during the usb ulpi interface registration process. In this failure scenario, the ulpi_register_interface() function invokes put_device() on the ulpi->dev structure, which subsequently triggers the device release callback ulpi_dev_release(). This callback properly handles cleanup by dropping the OF node reference and freeing the ulpi structure. However, the current error path then proceeds to call kfree(ulpi) again, resulting in the double free condition. This represents a classic memory safety issue where the same memory allocation is deallocated twice, violating fundamental memory management principles and creating potential for arbitrary code execution.
The operational impact of this vulnerability is significant within embedded systems and devices that rely on usb ulpi interfaces for low-power usb connectivity. Systems utilizing this kernel functionality may experience unexpected crashes, system hangs, or potentially exploitable memory corruption conditions. The vulnerability affects any device running a linux kernel version containing this specific ulpi driver implementation, particularly those using usb 2.0 low-power interface controllers in embedded platforms, network equipment, and automotive systems. The double free condition creates a potential attack surface for privilege escalation attacks, as the memory corruption could be leveraged to execute arbitrary code with kernel privileges.
The fix implemented addresses this issue by ensuring proper resource management flow where put_device() handles all cleanup operations through the ulpi_dev_release() callback, eliminating the redundant kfree(ulpi) call in the error path. This approach follows established kernel development practices for memory management and resource cleanup, preventing the double free condition while maintaining proper error handling. The solution aligns with common vulnerability remediation techniques outlined in the common weakness enumeration (cwe-415) and addresses the specific attack pattern documented in the attack tree framework. This fix demonstrates proper kernel memory management practices and represents a standard approach to preventing double free vulnerabilities in kernel space code, following the principle of least privilege and proper resource lifecycle management as recommended by industry security standards and best practices for embedded systems security.