CVE-2026-31520

The apple_report_fixup() function in the Linux kernel allocates a new buffer with kmemdup() but never releases it, leading to a memory leak. This flaw is a classic example of improper memory deallocation (CWE‑401) and also improper resource management (CWE‑772), and can cause the kernel to gradually consume available memory, potentially resulting in a system-wide denial‑of‑service.

All Linux kernel releases that contain the unmodified apple HID are affected, as the vulnerability exists in versions prior to the commit that introduced the fix. Users running a kernel with the legacy apple_report_fixup() implementation, regardless of distribution, are exposed.

The CVSS score of 5.5 indicates a medium severity. The EPSS score of less than 1% suggests a low probability of exploitation at the present time, and the vulnerability is not listed in CISA’s KEV catalog, pointing to limited known exploitation. However, based on the description, it is inferred that an attacker who can repeatedly trigger the Apple HID report processing—such as by connecting affected devices or via a compromised local user—could provoke the kernel to leak memory until resources are exhausted. The vulnerability does not provide code execution or privilege escalation; it primarily poses a risk of resource depletion.