CVE-2026-93188: HID: roccat: bound device-supplied profile index
In the Linux kernel, the following vulnerability has been resolved:
HID: roccat: bound device-supplied profile index
konekeepvaluesuptodate() and koneprofileactivated() use an 8-bit, device-supplied profile value as an index into the 5-element kone->profiles[] array without a range check. A malicious USB device claiming the Roccat Kone id can send a switch-profile event (or a startupprofile read at probe) with an out-of-range value and make the driver read out of bounds; the result is exposed via the actualdpi sysfs attribute.
Reject out-of-range indices in both paths.
This was found with static analysis and confirmed with the KUnit test added in the following patch (KASAN: slab-out-of-bounds).
Event History
Frequently Asked Questions
What systems are realistically exposed to this issue?
Systems are exposed if they use the Linux kernel Roccat Kone HID driver and accept input from a USB device that claims the Roccat Kone identity. The issue can be triggered by a malicious USB device, including during device probing through its startup profile value.
What does an attacker need to exploit it?
An attacker needs to connect or otherwise present a malicious USB device that impersonates a Roccat Kone device. The device must supply an out-of-range profile index through a switch-profile event or the startup_profile value read during probe.
How can an affected system be identified?
The vulnerable behavior is an out-of-bounds read in the Roccat Kone driver's handling of device-supplied profile indices, potentially observable through the actual_dpi sysfs attribute. KASAN can report it as a slab-out-of-bounds condition.