{"id":"CVE-2026-31520","title":"HID: apple: avoid memory leak in apple_report_fixup()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: apple: avoid memory leak in apple_report_fixup()\n\nThe apple_report_fixup() function was returning a\nnewly kmemdup()-allocated buffer, but never freeing it.\n\nThe ca…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 6e143293e17a73c9313f91c5ca3aaacbaef030cf < e2f090aeb7b9930a964e151910f4d45b04c8a7e5","Linux >= 6e143293e17a73c9313f91c5ca3aaacbaef030cf < 2635d0c715f3fb177e0f80ecd5fa48feb6bf3884","Linux >= 6e143293e17a73c9313f91c5ca3aaacbaef030cf < 31860c3f7ac66ab897a8c90dc4e74fa17ca0b624","Linux >= 6e143293e17a73c9313f91c5ca3aaacbaef030cf < be1a341c161430282acdfe2ac99b413271575cf1","Linux >= 6e143293e17a73c9313f91c5ca3aaacbaef030cf < e652ebd29928181c3e6820e303da25873e9917d4","Linux >= 6e143293e17a73c9313f91c5ca3aaacbaef030cf < 239c15116d80f67d32f00acc34575f1a6b699613","Linux 5.17"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T21:37:02.146634Z"},"published":"2026-04-22","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:45:05.120Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31520","references":[{"url":"https://git.kernel.org/stable/c/e2f090aeb7b9930a964e151910f4d45b04c8a7e5"},{"url":"https://git.kernel.org/stable/c/2635d0c715f3fb177e0f80ecd5fa48feb6bf3884"},{"url":"https://git.kernel.org/stable/c/31860c3f7ac66ab897a8c90dc4e74fa17ca0b624"},{"url":"https://git.kernel.org/stable/c/be1a341c161430282acdfe2ac99b413271575cf1"},{"url":"https://git.kernel.org/stable/c/e652ebd29928181c3e6820e303da25873e9917d4"},{"url":"https://git.kernel.org/stable/c/239c15116d80f67d32f00acc34575f1a6b699613"}],"tags":["cve.org"],"epss":0.00123,"epssPercentile":0.02056,"ingestedAt":"2026-11-05T23:41:31.978Z","slug":"CVE-2026-31520","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nHID: apple: avoid memory leak in apple_report_fixup()\n\nThe apple_report_fixup() function was returning a\nnewly kmemdup()-allocated buffer, but never freeing it.\n\nThe caller of report_fixup() does not take ownership of the returned\npointer, but it *is* permitted to return a sub-portion of the input\nrdesc, whose lifetime is managed by the caller.\n\n## Affected\n\n- `Linux >= 6e143293e17a73c9313f91c5ca3aaacbaef030cf < e2f090aeb7b9930a964e151910f4d45b04c8a7e5`\n- `Linux >= 6e143293e17a73c9313f91c5ca3aaacbaef030cf < 2635d0c715f3fb177e0f80ecd5fa48feb6bf3884`\n- `Linux >= 6e143293e17a73c9313f91c5ca3aaacbaef030cf < 31860c3f7ac66ab897a8c90dc4e74fa17ca0b624`\n- `Linux >= 6e143293e17a73c9313f91c5ca3aaacbaef030cf < be1a341c161430282acdfe2ac99b413271575cf1`\n- `Linux >= 6e143293e17a73c9313f91c5ca3aaacbaef030cf < e652ebd29928181c3e6820e303da25873e9917d4`\n- `Linux >= 6e143293e17a73c9313f91c5ca3aaacbaef030cf < 239c15116d80f67d32f00acc34575f1a6b699613`\n- `Linux 5.17`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}