CVE-2026-31522

HID: magicmouse: avoid memory leak in magicmouse_report_fixup()

State: Published
Severity: Not scored
Published: Apr 22, 2026
Updated: May 23, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: magicmouse: avoid memory leak in magicmouse_report_fixup()

The magicmouse_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it.

The caller of report_fixup() does not take ownership of the returned pointer, but it *is* permitted to return a sub-portion of the input rdesc, whose lifetime is managed by the caller.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e6ad399596bd234be4722022146e33e15c7e424d to before 579c4c9857acdc8380fa99803f355f878bd766cbAffected 0b91b4e4dae63cd43871fc2012370b86ee588f91 to before d84c21aabaab517b9aaf9bc1d785922cb9db2f31Affected 0b91b4e4dae63cd43871fc2012370b86ee588f91 to before 7edfe4346b052b708645d0acc0f186425766b785Affected 0b91b4e4dae63cd43871fc2012370b86ee588f91 to before 79e5dcc95d9abed6f8203cfd529f4ec71f0e505dAffected 0b91b4e4dae63cd43871fc2012370b86ee588f91 to before 136f605e246b4bfe7ac2259471d1ff814aed0084Affected 0b91b4e4dae63cd43871fc2012370b86ee588f91 to before fa95b0146358b49f9858139b67314591fd5871b0Affected 0b91b4e4dae63cd43871fc2012370b86ee588f91 to before 91e8c6e601bdc1ccdf886479b6513c01c7e51c2cAffected c394bd1bc8537e61593b6b6799e01495c7cf9008Affected 5.15.17 to before 5.15.203Affected 5.16.3 to before 5.17Affected
LinuxLinux	5.17Affected before 5.17Not affected 5.15.203 through 5.15.Not affected 6.1.168 through 6.1.Not affected 6.6.131 through 6.6.Not affected 6.12.80 through 6.12.Not affected 6.18.21 through 6.18.Not affected 6.19.11 through 6.19.Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

e6ad399596bd234be4722022146e33e15c7e424d to before 579c4c9857acdc8380fa99803f355f878bd766cbAffected
0b91b4e4dae63cd43871fc2012370b86ee588f91 to before d84c21aabaab517b9aaf9bc1d785922cb9db2f31Affected
0b91b4e4dae63cd43871fc2012370b86ee588f91 to before 7edfe4346b052b708645d0acc0f186425766b785Affected
0b91b4e4dae63cd43871fc2012370b86ee588f91 to before 79e5dcc95d9abed6f8203cfd529f4ec71f0e505dAffected
0b91b4e4dae63cd43871fc2012370b86ee588f91 to before 136f605e246b4bfe7ac2259471d1ff814aed0084Affected
0b91b4e4dae63cd43871fc2012370b86ee588f91 to before fa95b0146358b49f9858139b67314591fd5871b0Affected
0b91b4e4dae63cd43871fc2012370b86ee588f91 to before 91e8c6e601bdc1ccdf886479b6513c01c7e51c2cAffected
c394bd1bc8537e61593b6b6799e01495c7cf9008Affected
5.15.17 to before 5.15.203Affected
5.16.3 to before 5.17Affected

LinuxLinux

5.17Affected
before 5.17Not affected
5.15.203 through 5.15.*Not affected
6.1.168 through 6.1.*Not affected
6.6.131 through 6.6.*Not affected
6.12.80 through 6.12.*Not affected
6.18.21 through 6.18.*Not affected
6.19.11 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.