{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"e2f090aeb7b9930a964e151910f4d45b04c8a7e5","status":"affected","version":"6e143293e17a73c9313f91c5ca3aaacbaef030cf","versionType":"git"},{"lessThan":"2635d0c715f3fb177e0f80ecd5fa48feb6bf3884","status":"affected","version":"6e143293e17a73c9313f91c5ca3aaacbaef030cf","versionType":"git"},{"lessThan":"31860c3f7ac66ab897a8c90dc4e74fa17ca0b624","status":"affected","version":"6e143293e17a73c9313f91c5ca3aaacbaef030cf","versionType":"git"},{"lessThan":"be1a341c161430282acdfe2ac99b413271575cf1","status":"affected","version":"6e143293e17a73c9313f91c5ca3aaacbaef030cf","versionType":"git"},{"lessThan":"e652ebd29928181c3e6820e303da25873e9917d4","status":"affected","version":"6e143293e17a73c9313f91c5ca3aaacbaef030cf","versionType":"git"},{"lessThan":"239c15116d80f67d32f00acc34575f1a6b699613","status":"affected","version":"6e143293e17a73c9313f91c5ca3aaacbaef030cf","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"5.17"},{"lessThan":"5.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"cveId":"CVE-2026-31520","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: apple: avoid memory leak in apple_report_fixup()\n\nThe apple_report_fixup() function was returning a\nnewly kmemdup()-allocated buffer, but never freeing it.\n\nThe caller of report_fixup() does not take ownership of the returned\npointer, but it *is* permitted to return a sub-portion of the input\nrdesc, whose lifetime is managed by the caller.","epss":{"date":"2026-11-05","percentile":0.02045,"score":0.00123},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793915105120,"publishedAt":1776866075534,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/e2f090aeb7b9930a964e151910f4d45b04c8a7e5"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/2635d0c715f3fb177e0f80ecd5fa48feb6bf3884"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/31860c3f7ac66ab897a8c90dc4e74fa17ca0b624"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/be1a341c161430282acdfe2ac99b413271575cf1"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/e652ebd29928181c3e6820e303da25873e9917d4"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/239c15116d80f67d32f00acc34575f1a6b699613"}],"remediation":[],"revision":"7f0eadd0f43c32aa6d9cf8d029012ae6f2167363affe319f975ae12fe5733e3d","sources":[{"modifiedAt":1793915105120,"name":"CNA: Linux","retrievedAt":1793917079341,"url":"https://www.cve.org/CVERecord?id=CVE-2026-31520"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793917103409,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-31520"}],"ssvc":{"assessedAt":1793914622146,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"HID: apple: avoid memory leak in apple_report_fixup()","updatedAt":1793917103409}