CVE-2026-46109

Description

In the Linux kernel, the following vulnerability has been resolved: usb: ulpi: fix memory leak on ulpi_register() error paths Commit 01af542392b5 ("usb: ulpi: fix double free in ulpi_register_interface() error path") removed kfree(ulpi) from ulpi_register_interface() to fix a double-free when device_register() fails. But when ulpi_of_register() or ulpi_read_id() fail before device_register() is called, the ulpi allocation is leaked. Add kfree(ulpi) on both error paths to properly clean up the allocation.

Is your site exposed to CVE-2026-46109?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0018

Probability of exploitation

0.07%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/0b9fcab1b8608d429e5f239afb197de928d4de7d https://git.kernel.org/stable/c/0c2c0c6820fe96fa4be0a0499f8d3f3321b9af6c https://git.kernel.org/stable/c/2a71e01b2cf9b4329ff67102c1bea7448c2a2d2d https://git.kernel.org/stable/c/7bd61ed0bf9f4f1f2673d489b3bda1555b48d054 https://git.kernel.org/stable/c/b0c0d44adb55c66663886cb6e30ee92cbb0f5385 https://git.kernel.org/stable/c/be2c1d825f54277472c87019e82013ac534ddc4c https://git.kernel.org/stable/c/f1b855c00988a9cb41134cab7cf9faedba775dd9 https://git.kernel.org/stable/c/f30ccfc2985590b33a23a3d8bed7ca16c0af551b

Frequently Asked Questions

What is CVE-2026-46109? +

In the Linux kernel, the following vulnerability has been resolved: usb: ulpi: fix memory leak on ulpi_register() error paths Commit 01af542392b5 ("usb: ulpi: fix double free in ulpi_register_interface() error path") removed kfree(ulpi) from ulpi_register_interface() to fix a double-free when device_register() fails. But when ulpi_of_register() or ulpi_read_id() fail before device_register() is called, the ulpi allocation is leaked. Add kfree(ulpi) on both error paths to properly clean up the allocation.

How do I check if I'm vulnerable to CVE-2026-46109? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.