VulnerabilityPublished 22 Apr 2026Updated 5 Nov 2026

CVE-2026-31524: Linux kernel · HID: asus: avoid memory leak in asus_report_fixup()

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in f20f17cffbe34fb330267e0f8084f5565f807444 : update Linux kernel when convenient.

Data as of 5 Nov 2026, 22:06 UTC

Severity

Low

Rated Low by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-05.

Patch

Available – fixed in f20f17cffbe34fb330267e0f8084f5565f807444, ede95cfcab8064d9a08813fbd7ed42cea8843dcf, a41cc7c1668e44ff2c2d36f9a6353253ffc43e3c +5

Exploitation evidence

Disclosed: evidence found.
CVE published 22 Apr 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 5 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 5703e52cc711bc01e72cf12b86a126909c79d213, < f20f17cffbe34fb330267e0f8084f5565f807444	Fixed in f20f17cffbe34fb330267e0f8084f5565f807444
LinuxLinux	Affected ≥ 5703e52cc711bc01e72cf12b86a126909c79d213, < ede95cfcab8064d9a08813fbd7ed42cea8843dcf	Fixed in ede95cfcab8064d9a08813fbd7ed42cea8843dcf
LinuxLinux	Affected ≥ 5703e52cc711bc01e72cf12b86a126909c79d213, < a41cc7c1668e44ff2c2d36f9a6353253ffc43e3c	Fixed in a41cc7c1668e44ff2c2d36f9a6353253ffc43e3c
LinuxLinux	Affected ≥ 5703e52cc711bc01e72cf12b86a126909c79d213, < 726765b43deb2b4723869d673cc5fc6f7a3b2059	Fixed in 726765b43deb2b4723869d673cc5fc6f7a3b2059
LinuxLinux	Affected ≥ 5703e52cc711bc01e72cf12b86a126909c79d213, < 84724ac4821a160d47b84289adf139023027bdbb	Fixed in 84724ac4821a160d47b84289adf139023027bdbb
LinuxLinux	Affected ≥ 5703e52cc711bc01e72cf12b86a126909c79d213, < 7a6d6e4d8af044f94fa97e97af5ff2771e1fbebd	Fixed in 7a6d6e4d8af044f94fa97e97af5ff2771e1fbebd

AI-suggested

A fix is available and has been applied in the Linux kernel. Users and administrators should update to the fixed kernel versions containing the patches identified by the provided commit hashes. No additional mitigation is required beyond applying the official fix.

Description

A memory leak vulnerability in the Linux kernel's HID driver for Asus devices was fixed by changing the memory allocation method in the asus_report_fixup() function. The function previously returned a newly allocated buffer without freeing it, causing a memory leak. Additionally, a harmless out-of-bounds read was corrected by limiting the copied descriptor size.

Impact

The vulnerability could cause a memory leak in the Linux kernel when handling Asus HID devices, potentially leading to increased memory usage and reduced system stability over time. The out-of-bounds read was harmless and likely had no security impact. There is no indication of exploitation in the wild.

Summary

CVE-2026-31524 addresses a memory management issue in the Linux kernel's HID Asus driver. The asus_report_fixup() function returned a kmemdup()-allocated buffer that was never freed, leading to a memory leak. The fix involved switching to devm_kzalloc(), which automatically manages and frees memory when the device is removed. The vulnerability also included a minor out-of-bounds read, which was fixed by copying only the original descriptor size. The caller of report_fixup() does not take ownership of the returned pointer, so proper memory management is critical to avoid leaks.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Nov 2026, 22:06 UTC

Technical details

References

Community reviews

Related threats