The asus_report_fixup() function in the Linux kernel HID driver creates a buffer with kmemdup() but never frees it, leading to a memory leak that can grow the kernel’s memory usage over time. Additionally, the code copies data from the HID descriptor without necessarily matching the descriptor’s actual size, allowing an out‑of‑bounds read that could expose sensitive kernel memory contents. The vulnerability exploits improper memory management and bounds checking and could degrade system availability or reveal confidential information.

The issue affects the Linux kernel, specifically the ASUS HID driver implementation. No specific kernel release versions are cited in the advisory, so any installation of the kernel containing the unpatched asus HID driver is potentially vulnerable.

Based on the description, it is inferred that the flaw resides in kernel code, so it requires local execution of privileged code to trigger the memory allocation path. The CVSS score is 5.5 and the EPSS score is <1%, indicating a moderate severity with very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. However, a persistent memory leak can impact long‑term stability, and an out‑of‑bounds read could lead to information disclosure if an attacker can craft HID descriptors to be processed by the kernel.