CVE-2026-64332 Overview
CVE-2026-64332 is a memory leak vulnerability in the Linux kernel USB ULPI (UTMI+ Low Pin Interface) subsystem. The flaw exists in the ULPI device registration path, where the allocated device name is never released when early registration fails. Repeated failures can gradually exhaust kernel memory on affected systems.
The upstream fix initialises the device structure earlier and releases the initial reference whenever registration fails, ensuring the allocated name is properly freed.
Critical Impact
Repeated ULPI device registration failures leak kernel memory, potentially degrading system stability over time on systems with USB ULPI PHY hardware.
Affected Products
- Linux kernel (multiple stable branches receiving backports)
- Systems using the USB ULPI subsystem (drivers/usb/common/ulpi.c)
- Embedded and SoC platforms relying on ULPI USB PHY controllers
Discovery Timeline
- 2026-07-25 - CVE-2026-64332 published to NVD
- 2026-07-25 - Last updated in NVD database
Technical Details for CVE-2026-64332
Vulnerability Analysis
The vulnerability resides in the ULPI device registration routine within the Linux kernel USB common code. When a new ULPI device is created, the kernel allocates a device name string via dev_set_name() before completing registration. If registration fails at an early stage, the code path returns without invoking the cleanup that would free the allocated name.
Each failed registration attempt leaks the memory backing the device name. In production environments with hardware faults, driver load loops, or hotplug edge cases, this leak accumulates. The condition falls under [CWE-401] Missing Release of Memory after Effective Lifetime.
The impact is limited to local availability degradation. Exploitation is not remote, and no privilege escalation or code execution is possible through the leak itself.
Root Cause
The root cause is an incomplete error-handling path in the ULPI registration function. The device name was allocated before the struct device was fully initialised, so error branches could not safely call put_device() to release the associated memory. The corrective patch reorders the initialisation so that the device structure is set up first, allowing the initial reference to be dropped on any failure and letting the driver core free the name.
Attack Vector
The attack vector is local and requires conditions that cause ULPI device registration to fail repeatedly. A local user cannot directly trigger the registration path without appropriate hardware or driver interaction. The most realistic trigger scenarios involve faulty hardware, kernel module reload loops on ULPI-backed USB PHYs, or driver initialisation failures during boot or hotplug events.
Because no verified proof of concept is available, refer to the upstream commits for the exact code changes: Kernel Git Commit 1967a7f and Kernel Git Commit 624c571.
Detection Methods for CVE-2026-64332
Indicators of Compromise
- Growing kmalloc slab consumption in /proc/slabinfo correlated with USB subsystem activity
- Repeated ULPI registration failure messages in dmesg or journalctl -k output
- Gradual reduction in available kernel memory on systems with ULPI-connected USB PHYs
Detection Strategies
- Audit installed kernel package versions against the fixed stable branches referenced in the upstream commits
- Monitor kernel logs for ULPI registration errors that could indicate the leak is being triggered
- Track long-term slab allocator trends on embedded and SoC systems using ULPI USB PHYs
Monitoring Recommendations
- Collect kernel log telemetry centrally and alert on recurring ULPI or USB PHY registration failures
- Track kernel memory metrics (MemAvailable, Slab, SReclaimable) over time to catch gradual leaks
- Include kernel version inventory in configuration management to identify unpatched hosts
How to Mitigate CVE-2026-64332
Immediate Actions Required
- Identify Linux systems using the USB ULPI subsystem, particularly embedded devices and SoC platforms
- Apply vendor-supplied kernel updates that incorporate the upstream ULPI registration fix
- Reboot affected systems after patching to load the corrected kernel image
Patch Information
The fix has been merged across multiple stable Linux kernel branches. Reference commits include Kernel Git Commit 5c098f2, Kernel Git Commit 691e61e, Kernel Git Commit 88187a4, Kernel Git Commit 8af6812, Kernel Git Commit d5b32f3, and Kernel Git Commit e5493c9. Consume the fix through your distribution's kernel security update channel.
Workarounds
- No functional workaround exists; the leak is intrinsic to the pre-patch registration code path
- Reduce exposure by avoiding repeated reload of USB or ULPI-related kernel modules on unpatched hosts
- Schedule periodic reboots on unpatched embedded systems to reclaim leaked kernel memory until patches can be applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
