Memory Leak Vulnerability in Linux Kernel Affecting Magic Mouse Functionality

CVE-2026-31522

What is CVE-2026-31522?

A memory leak vulnerability has been identified in the Linux kernel's HID subsystem, specifically in the magicmouse_report_fixup() function. This issue arises from the allocation of a new buffer using kmemdup() that is not properly freed. Although the caller of report_fixup() is not responsible for managing the returned pointer's memory, it is allowed to return a sub-portion of the input report descriptor (rdesc), which the caller is responsible for. Failure to address this memory leak could lead to increased resource consumption and potentially impact system stability over time.

References