Executive brief
The Linux kernel's HID roccat driver fails to free buffered device reports when a Roccat hardware device is disconnected or closed. This memory leak prevents up to multiple report buffers from being released per device, potentially causing gradual memory exhaustion on systems with frequent device connect/disconnect cycles.
Technical details
The roccat_report_event() function in drivers/hid/hid-roccat.c allocates memory via kmemdup() to store device reports in a circular buffer (cbuf[]). These allocations are normally freed only when a buffer slot is reused. However, the device destruction paths (roccat_release() and roccat_disconnect()) were calling kfree() directly on the device structure without first releasing the buffered reports still stored in cbuf[], making those allocations unreachable. The fix adds a roccat_free_device() destructor function that iterates through all circular buffer slots and frees each report allocation before freeing the device structure itself. This is applied in both device destruction paths.
Affected products
- Linux Linux Kernel all versions (fix applied across stable series linux-3.x through linux-7.x)
Timeline
- 2026-09-11: disclosed: Vulnerability disclosed
- 2026-09-14: patched: Fix committed to stable kernel branches