CVE-2026-31522

Vulnerability

Overview

The magicmouse_report_fixup() function in the Linux kernel's HID magicmouse driver contains a memory leak. The function allocates a new buffer via kmemdup() but never frees it, as the caller does not take ownership of the returned pointer. The caller is permitted to return a sub-portion of the input report descriptor, whose lifetime is managed by the caller, but the newly allocated buffer is orphaned [1][2][3][4].

Exploitation

An attacker with physical access or the ability to connect a malicious HID device can trigger the vulnerable code path during device initialization. No authentication is required, and the attack can be repeated to gradually exhaust kernel memory, leading to a denial-of-service condition.

Impact

Successful exploitation results in a memory leak that can cause system memory exhaustion over time, potentially leading to system instability or crash. The CVSS v3 base score is 5.5 (Medium), reflecting the need for local access and the availability impact.

Mitigation

The fix has been applied to the Linux kernel stable tree and is available in multiple stable kernel updates [1][2][3][4]. Users should update their kernel to a version containing the patch to remediate the vulnerability.