CVE-2026-31524

HID: asus: avoid memory leak in asus_report_fixup()

State: Published
Severity: Not scored
Published: Apr 22, 2026
Updated: May 11, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: asus: avoid memory leak in asus_report_fixup()

The asus_report_fixup() function was returning a newly allocated kmemdup()-allocated buffer, but never freeing it. Switch to devm_kzalloc() to ensure the memory is managed and freed automatically when the device is removed.

The caller of report_fixup() does not take ownership of the returned pointer, but it is permitted to return a pointer whose lifetime is at least that of the input buffer.

Also fix a harmless out-of-bounds read by copying only the original descriptor size.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	5703e52cc711bc01e72cf12b86a126909c79d213 to before 726765b43deb2b4723869d673cc5fc6f7a3b2059Affected 5703e52cc711bc01e72cf12b86a126909c79d213 to before ede95cfcab8064d9a08813fbd7ed42cea8843dcfAffected 5703e52cc711bc01e72cf12b86a126909c79d213 to before 2e4fe6b15c2f390c023b20d728b1a3fe7ea4f973Affected 5703e52cc711bc01e72cf12b86a126909c79d213 to before f20f17cffbe34fb330267e0f8084f5565f807444Affected 5703e52cc711bc01e72cf12b86a126909c79d213 to before 7a6d6e4d8af044f94fa97e97af5ff2771e1fbebdAffected 5703e52cc711bc01e72cf12b86a126909c79d213 to before a41cc7c1668e44ff2c2d36f9a6353253ffc43e3cAffected 5703e52cc711bc01e72cf12b86a126909c79d213 to before 84724ac4821a160d47b84289adf139023027bdbbAffected 5703e52cc711bc01e72cf12b86a126909c79d213 to before 2bad24c17742fc88973d6aea526ce1353f5334a3Affected
LinuxLinux	4.14Affected before 4.14Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.168 through 6.1.Not affected 6.6.131 through 6.6.Not affected 6.12.80 through 6.12.Not affected 6.18.21 through 6.18.Not affected 6.19.11 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

5703e52cc711bc01e72cf12b86a126909c79d213 to before 726765b43deb2b4723869d673cc5fc6f7a3b2059Affected
5703e52cc711bc01e72cf12b86a126909c79d213 to before ede95cfcab8064d9a08813fbd7ed42cea8843dcfAffected
5703e52cc711bc01e72cf12b86a126909c79d213 to before 2e4fe6b15c2f390c023b20d728b1a3fe7ea4f973Affected
5703e52cc711bc01e72cf12b86a126909c79d213 to before f20f17cffbe34fb330267e0f8084f5565f807444Affected
5703e52cc711bc01e72cf12b86a126909c79d213 to before 7a6d6e4d8af044f94fa97e97af5ff2771e1fbebdAffected
5703e52cc711bc01e72cf12b86a126909c79d213 to before a41cc7c1668e44ff2c2d36f9a6353253ffc43e3cAffected
5703e52cc711bc01e72cf12b86a126909c79d213 to before 84724ac4821a160d47b84289adf139023027bdbbAffected
5703e52cc711bc01e72cf12b86a126909c79d213 to before 2bad24c17742fc88973d6aea526ce1353f5334a3Affected

LinuxLinux

4.14Affected
before 4.14Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.168 through 6.1.*Not affected
6.6.131 through 6.6.*Not affected
6.12.80 through 6.12.*Not affected
6.18.21 through 6.18.*Not affected
6.19.11 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.