CVE-2026-31520: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31520 is a memory leak vulnerability in the Linux kernel's HID Apple driver (drivers/hid/hid-apple.c). The apple_report_fixup() function allocates a new buffer via kmemdup() but never frees it, as the caller does not take ownership of the returned pointer. This affects Linux kernel versions 5.17 through multiple stable branches up to 6.19.10 and 7.0-rc1/rc2. It carries a CVSS v3.1 base score of 5.5 (Medium), with local attack vector and high availability impact (GitHub Advisory, Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In apple_report_fixup(), the function calls kmemdup() to allocate a new copy of the HID report descriptor buffer (rdesc), then returns this newly allocated pointer to the caller. However, the HID core's report_fixup callback contract does not transfer ownership of the returned pointer to the caller — it only permits returning a sub-portion of the original input rdesc, whose lifetime is managed by the caller. As a result, the kmemdup()-allocated buffer is orphaned on every invocation, leaking kernel memory. Exploitation requires only low privileges and no user interaction, as a local attacker can repeatedly trigger the driver path to accumulate leaked allocations (GitHub Advisory).

Successful exploitation causes gradual kernel memory exhaustion, leading to denial of service through system instability or an out-of-memory condition. Confidentiality and integrity are not affected; only availability is impacted. Systems actively using Apple HID peripherals (e.g., Apple keyboards or mice connected via USB or Bluetooth) are most at risk, as the vulnerable code path is exercised during device enumeration and report descriptor processing (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.024% (0.000240), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access with low privileges, limiting the practical attack surface (GitHub Advisory, Feedly).

Apply the available kernel patches for the relevant stable branch:

• 6.1.x: Update to 6.1.168 or later (kernel patch)
• 6.6.x: Update to 6.6.131 or later (kernel patch)
• 6.12.x: Update to 6.12.80 or later (kernel patch)
• 6.18.x: Update to 6.18.21 or later (kernel patch)
• 6.19.x: Update to 6.19.11 or later (kernel patch)
• 7.0-rc: Await final release with fix included

As a workaround where patching is not immediately possible, restrict local user access on systems using Apple HID devices and monitor kernel memory usage for signs of gradual depletion. The hid-apple kernel module can be blocklisted on systems that do not require Apple HID device support (GitHub Advisory, Feedly).