CVE-2026-31524
Description
In the Linux kernel, the following vulnerability has been resolved: HID: asus: avoid memory leak in asus_report_fixup() The asus_report_fixup() function was returning a newly allocated kmemdup()-allocated buffer, but never freeing it. Switch to devm_kzalloc() to ensure the memory is managed and freed automatically when the device is removed. The caller of report_fixup() does not take ownership of the returned pointer, but it is permitted to return a pointer whose lifetime is at least that of the input buffer. Also fix a harmless out-of-bounds read by copying only the original descriptor size.
How to fix
- linux linux_kernel5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11 or later
- git.kernel.org/stable/c/2bad24c17742fc88973d6aea526ce1353f5334a3
- git.kernel.org/stable/c/2e4fe6b15c2f390c023b20d728b1a3fe7ea4f973
- git.kernel.org/stable/c/726765b43deb2b4723869d673cc5fc6f7a3b2059
- git.kernel.org/stable/c/7a6d6e4d8af044f94fa97e97af5ff2771e1fbebd
- git.kernel.org/stable/c/84724ac4821a160d47b84289adf139023027bdbb
- git.kernel.org/stable/c/a41cc7c1668e44ff2c2d36f9a6353253ffc43e3c
- git.kernel.org/stable/c/ede95cfcab8064d9a08813fbd7ed42cea8843dcf
- git.kernel.org/stable/c/f20f17cffbe34fb330267e0f8084f5565f807444
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 4.14 ≤ v < 5.10.253, 5.11 ≤ v < 5.15.203, 5.16 ≤ v < 6.1.168, 6.2 ≤ v < 6.6.131, 6.7 ≤ v < 6.12.80, 6.13 ≤ v < 6.18.21, 6.19 ≤ v < 6.19.11, 7.0 | 5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.