CVE-2026-31520 Details
Description
In the Linux kernel, the following vulnerability has been resolved: HID: apple: avoid memory leak in apple_report_fixup() The apple_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it. The caller of report_fixup() does not take ownership of the returned pointer, but it *is* permitted to return a sub-portion of the input rdesc, whose lifetime is managed by the caller.
A memory leak vulnerability has been identified in the Linux kernel's HID Apple driver. The issue arises in the apple_report_fixup() function, which returns a buffer allocated with kmemdup() but fails to free it. Although the caller does not take ownership of this buffer, it can return a portion of the input report descriptor, managed by the caller's lifetime. This vulnerability affects the Linux kernel HID Apple driver in versions prior to the fix.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. The specific commit that resolves this issue is 239c15116d80f67d32f00acc34575f1a6b699613.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/239c15116d80f67d32f00acc34575f1a6b699613 | kernel.org | Patch |
| https://git.kernel.org/stable/c/2635d0c715f3fb177e0f80ecd5fa48feb6bf3884 | kernel.org | Patch |
| https://git.kernel.org/stable/c/31860c3f7ac66ab897a8c90dc4e74fa17ca0b624 | kernel.org | Patch |
| https://git.kernel.org/stable/c/be1a341c161430282acdfe2ac99b413271575cf1 | kernel.org | Patch |
| https://git.kernel.org/stable/c/e2f090aeb7b9930a964e151910f4d45b04c8a7e5 | kernel.org | Patch |
| https://git.kernel.org/stable/c/e652ebd29928181c3e6820e303da25873e9917d4 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.17, < 6.1.168 >= 6.2, < 6.6.131 >= 6.7, < 6.12.80 >= 6.13, < 6.18.21 >= 6.19, < 6.19.11 7.0 rc1 7.0 rc2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Apr 28, 2026 | Initial Analysis | [email protected] |
| Apr 22, 2026 | New CVE Received | kernel.org |