CVE-2026-31524
Description
In the Linux kernel, the following vulnerability has been resolved: HID: asus: avoid memory leak in asus_report_fixup() The asus_report_fixup() function was returning a newly allocated kmemdup()-allocated buffer, but never freeing it. Switch to devm_kzalloc() to ensure the memory is managed and freed automatically when the device is removed. The caller of report_fixup() does not take ownership of the returned pointer, but it is permitted to return a pointer whose lifetime is at least that of the input buffer. Also fix a harmless out-of-bounds read by copying only the original descriptor size.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
OS impact
Linux kernel Affected 2 releases
| Version | Status | Fixed in |
|---|---|---|
| 7.0 | Affected | — |
| — | Affected | 5.10.253 |
SUSE Affected 1 release
| Version | Status | Fixed in |
|---|---|---|
| — | Affected | — |
Debian Fixed 5 releases
| Version | Status | Fixed in |
|---|---|---|
| trixie | Fixed | 6.12.85-1 |
| sid | Fixed | 6.19.11-1 |
| forky | Fixed | 6.19.11-1 |
| bullseye | Fixed | 6.1.170-1~deb11u1 |
| bookworm | Fixed | 6.1.170-1 |
References
- https://git.kernel.org/stable/c/2bad24c17742fc88973d6aea526ce1353f5334a3
- https://git.kernel.org/stable/c/2e4fe6b15c2f390c023b20d728b1a3fe7ea4f973
- https://git.kernel.org/stable/c/726765b43deb2b4723869d673cc5fc6f7a3b2059
- https://git.kernel.org/stable/c/7a6d6e4d8af044f94fa97e97af5ff2771e1fbebd
- https://git.kernel.org/stable/c/84724ac4821a160d47b84289adf139023027bdbb
- https://git.kernel.org/stable/c/a41cc7c1668e44ff2c2d36f9a6353253ffc43e3c
- https://git.kernel.org/stable/c/ede95cfcab8064d9a08813fbd7ed42cea8843dcf
- https://git.kernel.org/stable/c/f20f17cffbe34fb330267e0f8084f5565f807444
- https://www.suse.com/security/cve/CVE-2026-31524.html
- https://security-tracker.debian.org/tracker/CVE-2026-31524
CWEs
CWE-401
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.