LiveActive security incident?Get immediate response
CVE Record

CVE-2026-46109: usb: ulpi: fix memory leak on ulpi_register() error paths

In the Linux kernel, the following vulnerability has been resolved: usb: ulpi: fix memory leak on ulpi_register() error paths Commit 01af542392b5 ("usb: ulpi: fix double free in ulpi_register_interface() error path") removed kfree(ulpi) from ulpi_register_interface() to fix a double-free when device_register() fails. But when ulpi_of_register() or ulpi_read_id() fail before device_register() is called, the ulpi allocation is leaked. Add kfree(ulpi) on both error paths to properly clean up the allocation.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

CVE-2026-46109 is a Linux kernel memory leak in USB ULPI device registration error handling. It wastes kernel memory only on specific failure paths. The source bundle provides no CVSS score, no KEV listing, and no evidence of active exploitation, so this looks operationally important for kernel hygiene but not currently business-critical from the provided evidence.

Executive priority

Treat as a routine Linux kernel patching item unless your environment depends on USB ULPI hardware in appliances or embedded systems. There is no source-provided evidence of active exploitation or a high-severity score.

Technical view

The Linux USB ULPI code can leak the allocated ulpi object when ulpi_of_register() or ulpi_read_id() fails before device_register() is called. The fix adds kfree(ulpi) on those error paths. The issue follows an earlier double-free fix that removed cleanup from a broader error path.

Likely exposure

Exposure is likely limited to Linux systems running affected kernels where USB ULPI registration paths are reachable. Business exposure depends on deployed hardware, kernel build options, and vendor backports. The summarized affected-version data is not sufficient to assert exposure for a specific distribution kernel.

Exploitation context

The source bundle does not show active exploitation, public weaponization, or KEV inclusion. A memory leak can contribute to reliability or denial-of-service risk in the right conditions, but the provided evidence does not establish practical exploitability or remote attack exposure.

Researcher notes

The vulnerability is narrowly described as missing cleanup on two pre-device_register() error paths. Useful follow-up is source review of affected branch backports and distro patches. The bundle does not provide CVSS, CWE, exploit status, or detailed affected distribution mapping.

Mitigation direction

  • Apply a vendor kernel update containing the referenced stable fixes for CVE-2026-46109.
  • Check Linux distribution advisories for backported fixes before relying on upstream version numbers.
  • Prioritize internet-facing or appliance-like systems only if they use relevant USB ULPI paths.
  • Track this as kernel maintenance if no affected hardware or driver path exists.

Validation and detection

  • Inventory running kernel versions and map them to vendor CVE-2026-46109 advisories.
  • Confirm whether kernels include the referenced upstream stable commits or vendor backports.
  • Review kernel configuration and hardware inventory for USB ULPI-related support.
  • Monitor kernel logs for repeated ULPI registration failures on affected systems.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-46109 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux2f70ba9dae13a190673cc3f9b4aad52179738f60, ee248e6e941e4f2e634df2bd43e5f1ef810ab6df, 272a9b26c336a295e4e209157fed809706c1b1f7, aaeae6533d77e6ed4def85baec01e2815ebbef61, 8763f8317bb389aded32a32b08f6751cfff657d2, 38c28fe25611099230f0965c925499bfcf46a795, 01af542392b5d41fd659d487015a71f627accce3, 01af542392b5d41fd659d487015a71f627accce3, a6e5461f076c2ef63159f18e5cdbd30b50f0bc15, 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12unaffected
LinuxLinux7.0, 0, 5.10.258, 5.15.209, 6.1.175, 6.6.140, 6.12.88, 6.18.30, 7.0.7, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.