The Linux kernel’s USB ULPI driver contains a double free flaw that occurs when device registration fails and the error path frees the ULPI structure a second time after the device release routine has already cleaned it up. The weakness is identified as a double free flaw (CWE-1341). This double free can corrupt kernel memory, potentially allowing an attacker with sufficient privileges or local access to gain elevated privileges or crash the system. Based on the description, this double free can corrupt kernel memory, potentially allowing an attacker with sufficient privileges or local access to gain elevated privileges or crash the system.

All Linux kernel releases that include the faulty ULPI USB driver are affected, as the vulnerability is present in the core kernel code. Because the patch has been committed in the upstream kernel repository, any distribution that has not yet applied the corrective commit in its kernel package remains impacted.

The CVSS score is 7.0, the EPSS score is also missing, so the exact likelihood of exploitation is uncertain. The vulnerability is not listed in the CISA KEV catalog, and no public exploits have been reported yet. The likely attack vector is local access or the ability to trigger the fault by interacting with USB devices that use the ULPI interface. The attacker would need to induce a device registration failure to trigger the double free, which suggests a moderate to high risk for systems running vulnerable kernels.