CVE-2026-31522 Details
Description
In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: avoid memory leak in magicmouse_report_fixup() The magicmouse_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it. The caller of report_fixup() does not take ownership of the returned pointer, but it *is* permitted to return a sub-portion of the input rdesc, whose lifetime is managed by the caller.
A memory leak vulnerability has been identified in the Linux kernel's HID magic mouse driver. The issue arises in the 'magicmouse_report_fixup()' function, which returns a buffer allocated with 'kmemdup()' but fails to free it. Although the function's caller does not take ownership of the returned pointer, it can return a portion of the input report descriptor, managed by the caller's lifetime. This vulnerability affects the Linux kernel stable tree.
Users can upgrade to the latest version of the Linux kernel, where this vulnerability has been addressed. Instructions for downloading the patched version can be found in the Linux kernel documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/136f605e246b4bfe7ac2259471d1ff814aed0084 | kernel.org | Patch |
| https://git.kernel.org/stable/c/579c4c9857acdc8380fa99803f355f878bd766cb | kernel.org | Patch |
| https://git.kernel.org/stable/c/79e5dcc95d9abed6f8203cfd529f4ec71f0e505d | kernel.org | Patch |
| https://git.kernel.org/stable/c/7edfe4346b052b708645d0acc0f186425766b785 | kernel.org | Patch |
| https://git.kernel.org/stable/c/91e8c6e601bdc1ccdf886479b6513c01c7e51c2c | kernel.org | Patch |
| https://git.kernel.org/stable/c/d84c21aabaab517b9aaf9bc1d785922cb9db2f31 | kernel.org | Patch |
| https://git.kernel.org/stable/c/fa95b0146358b49f9858139b67314591fd5871b0 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.15.17, < 5.15.203 >= 5.16.3, < 5.17 >= 5.17, < 6.1.168 >= 6.2, < 6.6.131 >= 6.7, < 6.12.80 >= 6.13, < 6.18.21 >= 6.19, < 6.19.11 7.0 rc1 7.0 rc2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Apr 28, 2026 | Initial Analysis | [email protected] |
| Apr 22, 2026 | New CVE Received | kernel.org |