CVE-2026-89627: HID: roccat: free buffered reports when destroying device
In the Linux kernel, the following vulnerability has been resolved:
HID: roccat: free buffered reports when destroying device
roccatreportevent() duplicates each report with kmemdup() and stores the allocation in a circular-buffer slot. The allocation is released only when that slot is reused.
The device destruction paths free struct roccatdevice without releasing reports still stored in cbuf[]. This makes those allocations unreachable and leaks up to ROCCATCBUFSIZE report buffers per device.
Add a small destructor that frees every buffered report before freeing the device, and use it in both paths that can destroy a registered device.
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this leak?
Systems using the Linux kernel's ROCCAT HID device support are exposed when registered ROCCAT devices receive buffered reports and are later destroyed. The leak is limited to report buffers retained in the driver's circular buffer at device teardown.
Does exploitation require an attacker to send specially crafted reports?
The provided information identifies a resource leak caused by normal report duplication and device destruction. It does not state that malformed or specially crafted reports are required.
What is the impact if the issue is triggered repeatedly?
Each affected device destruction can leave up to ROCCAT_CBUF_SIZE report-buffer allocations unreachable. Repeated device lifecycle events could therefore accumulate unreleased kernel memory.
What should be done if an update cannot be applied immediately?
The provided information does not specify a workaround. Reducing unnecessary connection, disconnection, or destruction of affected ROCCAT devices may limit opportunities for the leak to accumulate.