PT-2026-34429 · Linux · Linux Kernel

Published 2026-04-22 · Updated 2026-05-26 · CVE-2026-31524

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak occurs in the asus report fixup() function, which returns a buffer allocated via kmemdup() without subsequently freeing it. Additionally, an out-of-bounds read exists where the function copies more data than the original descriptor size.

Recommendations Update the asus report fixup() function to use devm kzalloc() to ensure memory is automatically managed and freed upon device removal. Restrict the data copy process to only include the original descriptor size to prevent out-of-bounds reads.

Fix

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2026-31524

ECHO-2D5C-3289-293D

Affected Products

Linux Kernel

References · 20

• https://git.kernel.org/stable/c/ede95cfcab8064d9a08813fbd7ed42cea8843dcf · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-31524 · Vendor Advisory
• https://git.kernel.org/stable/c/a41cc7c1668e44ff2c2d36f9a6353253ffc43e3c · Patch
• https://git.kernel.org/stable/c/726765b43deb2b4723869d673cc5fc6f7a3b2059 · Patch
• https://cve.org/CVERecord?id=CVE-2026-31524 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31524 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-31524 · Vendor Advisory
• https://git.kernel.org/stable/c/7a6d6e4d8af044f94fa97e97af5ff2771e1fbebd · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31524 · Vendor Advisory
• https://git.kernel.org/stable/c/2e4fe6b15c2f390c023b20d728b1a3fe7ea4f973 · Patch
• https://git.kernel.org/stable/c/84724ac4821a160d47b84289adf139023027bdbb · Patch
• https://ubuntu.com/security/CVE-2026-31524 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-31524 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31524 · Vendor Advisory
• https://git.kernel.org/stable/c/f20f17cffbe34fb330267e0f8084f5565f807444 · Patch