CVE-2026-31524
kernel: HID: asus: avoid memory leak in asus_report_fixup()
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · April 22, 2026
Updated · June 28, 2026
Description
A flaw was found in the Linux kernel's Human Interface Device (HID) subsystem, specifically within the ASUS HID driver. The asus_report_fixup() function did not properly manage allocated memory, resulting in a memory leak (CWE-401). This issue could allow a local attacker to consume system resources, potentially leading to a denial of service. A minor out-of-bounds read (CWE-125) was also identified, though it is considered harmless.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-763 · Release of Invalid Pointer or Reference