CVE-2026-31522

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-31522
In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: avoid memory leak in magicmouse_report_fixup() The magicmouse_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it. The caller of report_fixup() does not take ownership of the returned pointer, but it *is* permitted to return a sub-portion of the input rdesc, whose lifetime is managed by the caller.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/136f605e246b4bfe7ac2259471d1ff814aed0084 Patch
https://git.kernel.org/stable/c/579c4c9857acdc8380fa99803f355f878bd766cb Patch
https://git.kernel.org/stable/c/79e5dcc95d9abed6f8203cfd529f4ec71f0e505d Patch
https://git.kernel.org/stable/c/7edfe4346b052b708645d0acc0f186425766b785 Patch
https://git.kernel.org/stable/c/91e8c6e601bdc1ccdf886479b6513c01c7e51c2c Patch
https://git.kernel.org/stable/c/d84c21aabaab517b9aaf9bc1d785922cb9db2f31 Patch
https://git.kernel.org/stable/c/fa95b0146358b49f9858139b67314591fd5871b0 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
History

28 Apr 2026, 18:21

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/136f605e246b4bfe7ac2259471d1ff814aed0084 - () https://git.kernel.org/stable/c/136f605e246b4bfe7ac2259471d1ff814aed0084 - Patch
References () https://git.kernel.org/stable/c/579c4c9857acdc8380fa99803f355f878bd766cb - () https://git.kernel.org/stable/c/579c4c9857acdc8380fa99803f355f878bd766cb - Patch
References () https://git.kernel.org/stable/c/79e5dcc95d9abed6f8203cfd529f4ec71f0e505d - () https://git.kernel.org/stable/c/79e5dcc95d9abed6f8203cfd529f4ec71f0e505d - Patch
References () https://git.kernel.org/stable/c/7edfe4346b052b708645d0acc0f186425766b785 - () https://git.kernel.org/stable/c/7edfe4346b052b708645d0acc0f186425766b785 - Patch
References () https://git.kernel.org/stable/c/91e8c6e601bdc1ccdf886479b6513c01c7e51c2c - () https://git.kernel.org/stable/c/91e8c6e601bdc1ccdf886479b6513c01c7e51c2c - Patch
References () https://git.kernel.org/stable/c/d84c21aabaab517b9aaf9bc1d785922cb9db2f31 - () https://git.kernel.org/stable/c/d84c21aabaab517b9aaf9bc1d785922cb9db2f31 - Patch
References () https://git.kernel.org/stable/c/fa95b0146358b49f9858139b67314591fd5871b0 - () https://git.kernel.org/stable/c/fa95b0146358b49f9858139b67314591fd5871b0 - Patch
CPE cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-401

22 Apr 2026, 14:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-22 14:16

Updated : 2026-04-28 18:21

NVD link : CVE-2026-31522

Mitre link : CVE-2026-31522

CVE.ORG link : CVE-2026-31522

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime