Linux Kernel CVE-2026-31520

The Linux kernel HID (Human Interface Device) subsystem provides a report_fixup() callback mechanism allowing vendor-specific drivers to adjust or correct device report descriptors before the HID core parses them. The Apple HID driver (hid-apple.c) implements this via apple_report_fixup(). The bug is a violation of the callback's ownership contract: kmemdup() allocates a fresh kernel buffer and returns its pointer, but the HID core caller does not assume ownership of returned pointers - it only guarantees lifetime management for sub-pointers into the original rdesc input buffer. As a result, each device enumeration event leaks one kmemdup() allocation permanently. CWE-401 (Missing Release of Memory after Effective Lifetime) is the exact root cause class. Affected CPE: cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* across all branches prior to the fix commits. The 'Information Disclosure' tag in source intelligence conflicts with CVSS C:N and is not substantiated by the advisory - leaked kernel memory could theoretically retain prior contents but no such impact is documented.