Memory Leak Vulnerability in Linux Kernel Affecting ASUS Devices

CVE-2026-31524

What is CVE-2026-31524?

A memory leak has been identified in the Linux kernel's asus_report_fixup() function, where allocated buffers from kmemdup() were not being freed properly. This oversight needed a method ensure automatic memory management. The fix involves using devm_kzalloc() to allow proper memory allocation and deallocation when the device is removed. Additionally, an unrelated out-of-bounds read issue has been addressed by restricting the copy process to the original descriptor size.

References