CVE-2026-31524: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31524 is a memory leak vulnerability in the Linux kernel's HID ASUS driver, specifically within the asus_report_fixup() function. The function allocates a buffer via kmemdup() and returns it without ever freeing it, causing memory to leak each time the function is called. It affects Linux kernel versions from 4.14 through multiple stable branches, with fixed versions including 5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, and 7.0. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Feedly). The vulnerability was published on April 22, 2026.

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In asus_report_fixup(), a new buffer is allocated with kmemdup() and returned to the caller; however, the HID core's report_fixup() callback contract does not transfer ownership of the returned pointer to the caller, so the allocated memory is never freed. The fix replaces kmemdup() with devm_kzalloc(), which ties the allocation's lifetime to the device and ensures automatic cleanup upon device removal. Additionally, the patch corrects a secondary harmless out-of-bounds read by ensuring only the original descriptor size is copied (GitHub Advisory). Exploitation requires local access with low privileges, as the attacker must be able to trigger repeated report_fixup() invocations via HID device interactions.

Successful exploitation leads exclusively to an availability impact — there is no confidentiality or integrity risk. Repeated triggering of the memory leak can gradually exhaust kernel memory, potentially causing a denial-of-service condition, particularly on systems with limited RAM or long uptimes with frequent ASUS HID device reconnections. The scope is limited to the local system and does not facilitate lateral movement or data exfiltration (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges and physical or logical access to trigger HID device enumeration repeatedly.

Apply the available kernel patches, which are included in the following stable releases: 5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, and 7.0 (GitHub Advisory). Distribution-specific updates are available from Amazon Linux (ALAS2023-2026-1646, ALAS2023-2026-1681, ALAS2KERNEL-5.15-2026-102), SUSE (SUSE-SU-2026:2068-1), and Debian. If immediate patching is not feasible, consider restricting physical USB/HID device connections or disabling the ASUS HID kernel module (hid-asus) if it is not operationally required, and monitor system memory usage for signs of gradual exhaustion (Feedly).