CVE-2026-31524

Katalog CVE

CVSS 5.5 · Medium EPSS 0,16%

Kerentanan Missing Release of Memory after Effective Lifetime pada linux kernel. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

In the Linux kernel, the following vulnerability has been resolved: HID: asus: avoid memory leak in asus_report_fixup() The asus_report_fixup() function was returning a newly allocated kmemdup()-allocated buffer, but never freeing it. Switch to devm_kzalloc() to ensure the memory is managed and freed automatically when the device is removed. The caller of report_fixup() does not take ownership of the returned pointer, but it is permitted to return a pointer whose lifetime is at least that of the input buffer. Also fix a harmless out-of-bounds read by copying only the original descriptor size.

Rincian

Terbit di NVD

22 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-401: Missing Release of Memory after Effective Lifetime

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 4,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://git.kernel.org/stable/c/2bad24c17742fc88973d6aea526ce1353f5334a3 patch
• https://git.kernel.org/stable/c/2e4fe6b15c2f390c023b20d728b1a3fe7ea4f973 patch
• https://git.kernel.org/stable/c/726765b43deb2b4723869d673cc5fc6f7a3b2059 patch
• https://git.kernel.org/stable/c/7a6d6e4d8af044f94fa97e97af5ff2771e1fbebd patch
• https://git.kernel.org/stable/c/84724ac4821a160d47b84289adf139023027bdbb patch
• https://git.kernel.org/stable/c/a41cc7c1668e44ff2c2d36f9a6353253ffc43e3c patch
• https://git.kernel.org/stable/c/ede95cfcab8064d9a08813fbd7ed42cea8843dcf patch
• https://git.kernel.org/stable/c/f20f17cffbe34fb330267e0f8084f5565f807444 patch