PT-2026-34429 · Linux · Linux Kernel

Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-31524

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak occurs in the asus report fixup() function, which returns a buffer allocated via kmemdup() without subsequently freeing it. Additionally, an out-of-bounds read exists where the function copies more data than the original descriptor size.

Recommendations Update the asus report fixup() function to use devm kzalloc() to ensure memory is automatically managed and freed upon device removal. Restrict the data copy process to only include the original descriptor size to prevent out-of-bounds reads.

Related Identifiers

CVE-2026-31524

Affected Products

Linux Kernel

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-31524 · Security Note
• https://git.kernel.org/stable/c/2e4fe6b15c2f390c023b20d728b1a3fe7ea4f973 · Note
• https://git.kernel.org/stable/c/f20f17cffbe34fb330267e0f8084f5565f807444 · Note
• https://git.kernel.org/stable/c/ede95cfcab8064d9a08813fbd7ed42cea8843dcf · Note
• https://twitter.com/CVEnew/status/2046979944618627292 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2047035224517644439 · Twitter Post
• https://git.kernel.org/stable/c/726765b43deb2b4723869d673cc5fc6f7a3b2059 · Note
• https://git.kernel.org/stable/c/2bad24c17742fc88973d6aea526ce1353f5334a3 · Note
• https://git.kernel.org/stable/c/a41cc7c1668e44ff2c2d36f9a6353253ffc43e3c · Note
• https://git.kernel.org/stable/c/7a6d6e4d8af044f94fa97e97af5ff2771e1fbebd · Note
• https://git.kernel.org/stable/c/84724ac4821a160d47b84289adf139023027bdbb · Note