CVE-2026-31759

HighCVSS 7.8/10Last modified Nov 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: ulpi: fix double free in ulpi_register_interface() error path

When device_register() fails, ulpi_register() calls put_device() on ulpi->dev.

The device release callback ulpi_dev_release() drops the OF node reference and frees ulpi, but the current error path in ulpi_register_interface() then calls kfree(ulpi) again, causing a double free.

Let put_device() handle the cleanup through ulpi_dev_release() and avoid freeing ulpi again in ulpi_register_interface().

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-415

Affected software

VendorProductVersions
LinuxLinux>= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f, < 2f70ba9dae13a190673cc3f9b4aad52179738f60; >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f, < ee248e6e941e4f2e634df2bd43e5f1ef810ab6df; >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f, < 272a9b26c336a295e4e209157fed809706c1b1f7; >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f, < aaeae6533d77e6ed4def85baec01e2815ebbef61; >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f, < 8763f8317bb389aded32a32b08f6751cfff657d2; >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f, < 38c28fe25611099230f0965c925499bfcf46a795; >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f, < a6e5461f076c2ef63159f18e5cdbd30b50f0bc15; >= 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f, < 01af542392b5d41fd659d487015a71f627accce3
LinuxLinux4.2

References

Timeline

Published
May 1, 2026
Last modified
Nov 11, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-31763.1GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 thatCVE-2026-317605.5In the Linux kernel, the following vulnerability has been resolved: gpib: lpvo_usb: fix memory leak on disconnect The driver iterates overCVE-2026-317617.8In the Linux kernel, the following vulnerability has been resolved: iio: gyro: mpu3050: Move iio_device_register() to correct location iioCVE-2026-317625.5In the Linux kernel, the following vulnerability has been resolved: iio: gyro: mpu3050: Fix irq resource leak The interrupt handler is setCVE-2026-317635.5In the Linux kernel, the following vulnerability has been resolved: iio: gyro: mpu3050: Fix incorrect free_irq() variable The handler for CVE-2026-317647.8In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer oCVE-2026-317655.5In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB Currently, AMDCVE-2026-317667.1In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate doorbell_offset in user queue creation amdgpu_useCVE-2026-317675.5In the Linux kernel, the following vulnerability has been resolved: drm/i915/dsi: Don't do DSC horizontal timing adjustments in command modCVE-2026-317687.8In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() Add a DMA-CVE-2026-317697.8In the Linux kernel, the following vulnerability has been resolved: gpib: fix use-after-free in IO ioctl handlers The IBRD, IBWRT, IBCMD, CVE-2026-31775.3The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Insuffici
CVE-2026-31759: High severity, CVSS 7.8 | Vulnix