Linux Kernel EUVD-2026-26572

The vulnerability affects the USB ULPI (UTMI+ Low Pin Interface) subsystem introduced in Linux 4.2, specifically the device registration error path in drivers/usb/common/ulpi.c. ULPI is a physical interface specification for connecting USB transceivers to USB controllers. The flaw is a classic use-after-free/double-free (CWE-415) in the ulpi_register_interface() function. When device_register() fails, the code correctly calls put_device() which decrements the device reference count and eventually triggers ulpi_dev_release() callback. This callback performs proper cleanup including of_node_put() to drop device tree references and kfree(ulpi) to deallocate the structure. However, the error path then executes a second kfree(ulpi), attempting to free already-released memory. This corrupts kernel heap metadata and can lead to arbitrary memory operations when the freed region is reallocated. The vulnerability persists across multiple stable kernel branches from 4.2 through 6.x versions until patched in early 2026.