Executive brief
A vulnerability exists in the Linux kernel's support for Roccat hardware devices. A local user could potentially exploit a race condition to crash the system or execute unauthorized code. This affects the stability and security of Linux-based workstations using these specific peripherals.
Technical details
A use-after-free vulnerability exists in drivers/hid/hid-roccat.c within the Linux kernel. The function roccat_report_event() iterates over the device->readers list without acquiring the readers_lock mutex. This creates a race condition where a concurrent call to roccat_release() can remove and free a reader object while it is still being accessed by the reporting function. A local attacker with access to the device can exploit this race condition to trigger a use-after-free state, potentially leading to kernel memory corruption, a system crash (DoS), or arbitrary code execution in kernel context. The issue has been resolved by ensuring the readers_lock is held during list traversal.
Affected products
- Linux Linux Kernel 2.6.35 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-05-06: disclosed
- 2026-05-06: advisory
- 2026-04-22: patched: Initial patch commit in stable tree
References
- https://git.kernel.org/stable/c/181ea51ab0f6370842c5b49cfb86824253a1189e
- https://git.kernel.org/stable/c/20dca865460f7943cf70afca274b60dac371f546
- https://git.kernel.org/stable/c/36bb2d0b915014bbdc5044982b31b57b78045b93
- https://git.kernel.org/stable/c/441689e3103694caa3e2d62b7d57c7bccefa5e37
- https://git.kernel.org/stable/c/bca0b595e15450dd66b1153c76c4ef1087ee011b
- https://git.kernel.org/stable/c/d802d848308b35220f21a8025352f0c0aba15c12
- https://git.kernel.org/stable/c/e16a6d11bd77b81632165f02cf0d5946df74b3b7