CVE-2026-46109

Technical summary

CVE-2026-46109 describes a memory leak in the Linux kernel's USB ULPI subsystem, specifically in the ulpi_register() function. A previous patch (commit 01af542392b5) removed a kfree(ulpi) call to prevent double-free errors when device_register() failed. However, this left two error paths unprotected: when ulpi_of_register() or ulpi_read_id() fail before device_register() is invoked, the allocated ulpi structure is not freed. The fix adds kfree(ulpi) to both early error paths, ensuring proper cleanup regardless of where registration fails. This is classified as CWE-401 (Missing Release of Memory after Effective Lifetime).

Business impact

On affected systems, repeated USB ULPI device registration failures could gradually exhaust kernel memory. In environments with frequent device hotplug events, failed driver initialization, or fuzzing/stress testing, this could degrade system stability or enable denial-of-service conditions. Systems with strict memory constraints (embedded devices, IoT, containerized deployments) face heightened risk. However, practical exploitation requires local system access and the ability to trigger specific USB enumeration failures.

Affected systems

All Linux kernel versions containing the vulnerable ulpi_register() code path are affected. This includes most recent stable releases (6.x series) and long-term support kernels (5.15.x, 5.10.x, etc.) until patched. The impact is broadest on systems with active USB ULPI devices (transceiver interfaces) or development/testing environments performing frequent USB device registration. Older kernels prior to the introduction of ULPI subsystem functionality are unaffected.

Exploitability

Exploitation requires local system access and the ability to trigger USB ULPI device registration failures. This is not a remote vulnerability and does not provide code execution or privilege escalation directly. The leak accumulates gradually rather than enabling immediate system compromise. Denial-of-service potential exists only in scenarios with repeated device initialization attempts or sustained memory pressure. The vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog.

Remediation

Apply the upstream Linux kernel patch that adds kfree(ulpi) calls to both ulpi_of_register() and ulpi_read_id() error paths in drivers/usb/ulpi/ulpi.c. Verify the fix is present in your kernel version before deploying. Distributions should backport this fix to all supported stable branches. No workaround exists for unpatched systems; patching is the only mitigation.

Patch guidance

Monitor your Linux distribution's security advisories for kernel updates addressing CVE-2026-46109. Verify patch inclusion by checking kernel source against the upstream fix or reviewing vendor release notes. For systems using long-term support kernels (5.10.x, 5.15.x, 6.1.x), prioritize updates from your distribution's LTS channels. Test patched kernels in non-production environments before rolling out widely to ensure compatibility with your USB device ecosystem.

Detection guidance

Kernel memory accounting tools (kmemcheck, kmemleak) can identify cumulative memory leaks if enabled at build time. Monitor syslog for repeated USB ULPI enumeration failures or device_register() errors, which may indicate repeated trigger attempts. Memory pressure events in kernel logs coupled with USB device attachment/detachment patterns warrant investigation. Runtime memory profiling during development or testing may reveal increasing unaccounted kernel memory tied to USB operations.

Why prioritize this

While this is a medium-severity memory leak, prioritization should reflect your environment's USB ULPI usage and memory constraints. Embedded and IoT deployments, Kubernetes clusters with device passthrough, and heavily tested development systems should patch sooner. Production servers without active ULPI devices or specialized USB transceiver hardware can deprioritize relative to critical vulnerabilities, but should still schedule patching within normal maintenance windows.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects local-only access requirements (AV:L), low complexity (AC:L), need for user-level or higher privileges (PR:L), and availability impact (A:H) with no confidentiality or integrity compromise. The score appropriately penalizes the memory leak's denial-of-service potential while acknowledging practical barriers to exploitation on typical systems. Actual risk to your organization depends on USB ULPI device prevalence, system memory availability, and exposure to untrusted device attachment.

Frequently asked questions