Skip to main content

Linux Kernel CVE-2026-31522

| EUVDEUVD-2026-24909 MEDIUM
Memory Leak (CWE-401)
2026-04-22 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Generated
Apr 28, 2026 - 18:22 vuln.today
CVSS changed
Apr 28, 2026 - 18:22 NVD
5.5 (MEDIUM)
Patch released
Apr 28, 2026 - 18:21 nvd
Patch available
Patch available
Apr 22, 2026 - 16:33 EUVD
EUVD ID Assigned
Apr 22, 2026 - 14:22 euvd
EUVD-2026-24909
Analysis Generated
Apr 22, 2026 - 14:22 vuln.today
CVE Published
Apr 22, 2026 - 14:16 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

HID: magicmouse: avoid memory leak in magicmouse_report_fixup()

The magicmouse_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it.

The caller of report_fixup() does not take ownership of the returned pointer, but it *is* permitted to return a sub-portion of the input rdesc, whose lifetime is managed by the caller.

AnalysisAI

Memory leak in the HID magicmouse driver's report_fixup() function allows local authenticated attackers to cause a denial of service through repeated device interactions. The magicmouse_report_fixup() function allocates memory via kmemdup() but fails to free the allocated buffer before returning, leading to exhaustion of kernel memory on systems with a Magic Mouse connected. Vendor patches are available across multiple stable branches.

Technical ContextAI

The vulnerability exists in the HID (Human Interface Device) magicmouse driver subsystem (drivers/hid/hid-magicmouse.c), which handles input from Apple Magic Mouse devices. The report_fixup() callback is part of the HID device descriptor fixup mechanism, invoked during device initialization to modify or replace the raw HID report descriptor. The function incorrectly uses kmemdup() to allocate a copy of the report descriptor but fails to deallocate this memory before returning. Unlike other callers of report_fixup(), the HID subsystem does not assume ownership of a newly allocated buffer; it expects either the original input pointer or a pointer to existing memory whose lifetime is managed by the caller. The root cause is a memory management oversight (CWE-401: Missing Release of Memory after Effective Lifetime), specifically the failure to pair allocation with deallocation in a function path.

RemediationAI

Vendor-released patches are available for all supported stable kernel branches. Update to kernel 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, or 7.0 release (when available), or apply the corresponding stable branch commits from https://git.kernel.org/stable/. For systems unable to update immediately, the following mitigations are available: (1) Disconnect the Magic Mouse device or blacklist the hid-magicmouse driver via 'modprobe -r hid_magicmouse' and adding 'blacklist hid_magicmouse' to /etc/modprobe.d/blacklist.conf - this eliminates the attack surface at the cost of Magic Mouse functionality, (2) Restrict user-level access to HID devices via udev rules or AppArmor/SELinux policies to prevent unprivileged users from triggering device interactions, though this may impact legitimate usage, or (3) Apply resource limits to user processes using cgroups v2 memory limits to contain memory leak impact, though this does not prevent the leak itself. Patched versions are strongly recommended as they fix the underlying defect without operational workarounds.

Same weakness CWE-401 – Memory Leak

View all
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1
CVE-2023-23145 HIGH POC
7.8
CVE-2022-35858 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31522 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy