exploitDog

CVE-2026-31759

Опубликовано: 01 мая 2026

Источник: nvd

CVSS3: 7.8

EPSS Низкий

Описание

In the Linux kernel, the following vulnerability has been resolved:

usb: ulpi: fix double free in ulpi_register_interface() error path

When device_register() fails, ulpi_register() calls put_device() on ulpi->dev.

The device release callback ulpi_dev_release() drops the OF node reference and frees ulpi, but the current error path in ulpi_register_interface() then calls kfree(ulpi) again, causing a double free.

Let put_device() handle the cleanup through ulpi_dev_release() and avoid freeing ulpi again in ulpi_register_interface().

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 4.2 (включая) до 5.10.253 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 5.11 (включая) до 5.15.203 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 5.16 (включая) до 6.1.168 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 6.2 (включая) до 6.6.134 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 6.7 (включая) до 6.12.81 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 6.13 (включая) до 6.18.22 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 6.19 (включая) до 6.19.12 (исключая)

cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*

EPSS

Процентиль: 3%

0.00129

Низкий

7.8 High

CVSS3

Дефекты

CWE-415

Связанные уязвимости

CVE-2026-31759

CVSS3: 7.8

ubuntu

3 месяца назад

In the Linux kernel, the following vulnerability has been resolved: usb: ulpi: fix double free in ulpi_register_interface() error path When device_register() fails, ulpi_register() calls put_device() on ulpi->dev. The device release callback ulpi_dev_release() drops the OF node reference and frees ulpi, but the current error path in ulpi_register_interface() then calls kfree(ulpi) again, causing a double free. Let put_device() handle the cleanup through ulpi_dev_release() and avoid freeing ulpi again in ulpi_register_interface().

CVE-2026-31759

CVSS3: 5.5

redhat

3 месяца назад

In the Linux kernel, the following vulnerability has been resolved: usb: ulpi: fix double free in ulpi_register_interface() error path When device_register() fails, ulpi_register() calls put_device() on ulpi->dev. The device release callback ulpi_dev_release() drops the OF node reference and frees ulpi, but the current error path in ulpi_register_interface() then calls kfree(ulpi) again, causing a double free. Let put_device() handle the cleanup through ulpi_dev_release() and avoid freeing ulpi again in ulpi_register_interface().

CVE-2026-31759

CVSS3: 7.8

debian

3 месяца назад

In the Linux kernel, the following vulnerability has been resolved: u ...

GHSA-x34j-qcqj-w3pm

CVSS3: 7.8

github

3 месяца назад

In the Linux kernel, the following vulnerability has been resolved: usb: ulpi: fix double free in ulpi_register_interface() error path When device_register() fails, ulpi_register() calls put_device() on ulpi->dev. The device release callback ulpi_dev_release() drops the OF node reference and frees ulpi, but the current error path in ulpi_register_interface() then calls kfree(ulpi) again, causing a double free. Let put_device() handle the cleanup through ulpi_dev_release() and avoid freeing ulpi again in ulpi_register_interface().

SUSE-SU-2026:2638-1

suse-cvrf

около 1 месяца назад

Security update for the Linux Kernel

EPSS

Процентиль: 3%

0.00129

Низкий

7.8 High

CVSS3

Дефекты

CWE-415