Skip to main content

Linux Kernel CVE-2026-31524

| EUVDEUVD-2026-24913 MEDIUM
Memory Leak (CWE-401)
2026-04-22 416baaa9-dc9f-4396-8d5f-8c081fb06d67
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Generated
Apr 28, 2026 - 18:22 vuln.today
CVSS changed
Apr 28, 2026 - 18:22 NVD
5.5 (MEDIUM)
Patch released
Apr 28, 2026 - 18:07 nvd
Patch available
Patch available
Apr 22, 2026 - 16:33 EUVD
EUVD ID Assigned
Apr 22, 2026 - 14:22 euvd
EUVD-2026-24913
Analysis Generated
Apr 22, 2026 - 14:22 vuln.today
CVE Published
Apr 22, 2026 - 14:16 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

HID: asus: avoid memory leak in asus_report_fixup()

The asus_report_fixup() function was returning a newly allocated kmemdup()-allocated buffer, but never freeing it. Switch to devm_kzalloc() to ensure the memory is managed and freed automatically when the device is removed.

The caller of report_fixup() does not take ownership of the returned pointer, but it is permitted to return a pointer whose lifetime is at least that of the input buffer.

Also fix a harmless out-of-bounds read by copying only the original descriptor size.

AnalysisAI

Memory leak and out-of-bounds read in the asus_report_fixup() HID driver function allows local authenticated attackers with limited privileges to cause denial of service through memory exhaustion. The vulnerability affects the ASUS HID device driver across multiple Linux kernel versions, where kmemdup()-allocated buffers were not freed properly and an out-of-bounds read could access memory beyond the original descriptor size. A patch is available from Linux kernel maintainers switching to devm_kzalloc() for proper memory lifecycle management.

Technical ContextAI

The vulnerability exists in the Linux kernel's HID (Human Interface Device) subsystem, specifically in the ASUS-specific report fixup handler (drivers/hid/hid-asus.c). The asus_report_fixup() function handles HID report descriptor normalization for ASUS devices. The root cause is improper memory management: kmemdup() allocated a buffer to duplicate the HID report descriptor, but the returned pointer was never freed, causing accumulated memory leaks as devices are connected and disconnected. Additionally, the function performed an out-of-bounds read by copying beyond the original descriptor size. The fix employs devm_kzalloc(), a device-managed allocation function that automatically frees memory when the associated HID device is removed, eliminating both the leak and the boundary violation. This affects the HID subsystem's device driver infrastructure rather than a protocol or core kernel component, making the impact limited to systems using ASUS HID devices.

RemediationAI

Apply kernel updates to patched versions: Linux 5.10.253 or later, 5.15.203 or later, 6.1.168 or later, 6.6.131 or later, 6.12.80 or later, 6.18.21 or later, 6.19.11 or later, or 7.0 stable release and later. Patches are available from kernel.org stable branches via the Git commit references listed in the CVE advisory (git.kernel.org/stable/c/[commit-hash]). For systems unable to immediately upgrade, the primary workaround is to blacklist or avoid loading the asus_hid driver if ASUS HID devices are not present (echo 'blacklist hid_asus' >> /etc/modprobe.d/blacklist.conf and rebuild initramfs if the driver is built-in), though this eliminates ASUS device functionality. Alternatively, if ASUS devices are connected infrequently, reduce exposure by minimizing device hotplug cycles. Systems using distribution-provided kernels should check with their vendor's security advisory portal for patched kernel releases (Debian, Ubuntu, RHEL, SUSE, etc. each maintain their own stable branches with backported fixes). Kernel rebuilds from source with patches are an option for systems requiring immediate remediation and cannot wait for vendor releases.

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31524 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy