FlawAtlas
Search the atlas
CVE-2026-31524 Not scored

HID: asus: avoid memory leak in asus_report_fixup()

In the Linux kernel, the following vulnerability has been resolved: HID: asus: avoid memory leak in asus_report_fixup() The asus_report_fixup() function was returning a newly allocated kmemdup()-allocated buffer, but never freeing it. Switch to devm_kzalloc() to ensure the memory is managed and freed automatically when the device is removed. The caller of report_fixup() does not take ownership of the returned pointer, but it is permitted to return a pointer whose lifetime is at least that of the input buffer. Also fix a harmless out-of-bounds read by copying only the original descriptor size.

Exploit probability 0.1%
Published April 22, 2026
Required by Not available
Last source change July 22, 2026

02 / AFFECTED SOFTWARE

Affected packages

Unknown Unknown
Linux Kernel

03 / CONNECTIONS

Connected vulnerabilities

related SUSE-SU-2026:2068-1

04 / EVIDENCE

Source records

Open Source Vulnerabilities CVE-2026-31524

In the Linux kernel, the following vulnerability has been resolved: HID: asus: avoid memory leak in asus_report_fixup() The asus_report_fixup() function was returning a newly allocated kmemdup()-allocated buffer, but never freeing it. Switch to devm_kzalloc() to ensure the memory is managed and freed automatically when the device is removed. The caller of report_fixup() does not take ownership of the returned pointer, but it is permitted to return a pointer whose lifetime is at least that of the input buffer. Also fix a harmless out-of-bounds read by copying only the original descriptor size.

View original source

05 / REFERENCES

Further evidence