The Linux kernel contains a memory‑leak flaw in ULPI registration. When ulpi_of_register() or ulpi_read_id() fail before device_register() runs, the allocated ULPI structure is never freed, causing kernel memory to leak. If an attacker can repeatedly trigger these failure paths, the kernel can run out of memory, leading to a system stall or reboot. This is a classic memory‑leak weakness and also represents resource exhaustion (CWE‑772).

All Linux kernel releases that include the ULPI code path and have not applied the patch from commit 01af5423 are affected. The fix removes the double‑free and adds a kfree on error paths. System administrators should verify whether their kernel version includes this commit or equivalent changes.

The EPSS score of < 1% indicates a very low chance of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation would require triggering the ULPI error paths, which typically requires privileged kernel access or direct interaction with the USB subsystem. Therefore, the likely attack vector is a local privileged attacker. Remote exploitation is unlikely, whereas a local privileged attacker or a misconfigured kernel driver could lead to kernel memory exhaustion and a denial of service.