CVE-2026-31520

HID: apple: avoid memory leak in apple_report_fixup()

State: Published
Severity: Not scored
Published: Apr 22, 2026
Updated: May 11, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: apple: avoid memory leak in apple_report_fixup()

The apple_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it.

The caller of report_fixup() does not take ownership of the returned pointer, but it *is* permitted to return a sub-portion of the input rdesc, whose lifetime is managed by the caller.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	6e143293e17a73c9313f91c5ca3aaacbaef030cf to before e2f090aeb7b9930a964e151910f4d45b04c8a7e5Affected 6e143293e17a73c9313f91c5ca3aaacbaef030cf to before 2635d0c715f3fb177e0f80ecd5fa48feb6bf3884Affected 6e143293e17a73c9313f91c5ca3aaacbaef030cf to before 31860c3f7ac66ab897a8c90dc4e74fa17ca0b624Affected 6e143293e17a73c9313f91c5ca3aaacbaef030cf to before be1a341c161430282acdfe2ac99b413271575cf1Affected 6e143293e17a73c9313f91c5ca3aaacbaef030cf to before e652ebd29928181c3e6820e303da25873e9917d4Affected 6e143293e17a73c9313f91c5ca3aaacbaef030cf to before 239c15116d80f67d32f00acc34575f1a6b699613Affected
LinuxLinux	5.17Affected before 5.17Not affected 6.1.168 through 6.1.Not affected 6.6.131 through 6.6.Not affected 6.12.80 through 6.12.Not affected 6.18.21 through 6.18.Not affected 6.19.11 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

6e143293e17a73c9313f91c5ca3aaacbaef030cf to before e2f090aeb7b9930a964e151910f4d45b04c8a7e5Affected
6e143293e17a73c9313f91c5ca3aaacbaef030cf to before 2635d0c715f3fb177e0f80ecd5fa48feb6bf3884Affected
6e143293e17a73c9313f91c5ca3aaacbaef030cf to before 31860c3f7ac66ab897a8c90dc4e74fa17ca0b624Affected
6e143293e17a73c9313f91c5ca3aaacbaef030cf to before be1a341c161430282acdfe2ac99b413271575cf1Affected
6e143293e17a73c9313f91c5ca3aaacbaef030cf to before e652ebd29928181c3e6820e303da25873e9917d4Affected
6e143293e17a73c9313f91c5ca3aaacbaef030cf to before 239c15116d80f67d32f00acc34575f1a6b699613Affected

LinuxLinux

5.17Affected
before 5.17Not affected
6.1.168 through 6.1.*Not affected
6.6.131 through 6.6.*Not affected
6.12.80 through 6.12.*Not affected
6.18.21 through 6.18.*Not affected
6.19.11 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.