Executive brief
The Linux kernel's Roccat Kone gaming mouse driver fails to validate profile index values supplied by USB devices, allowing a malicious or compromised mouse to trigger an out-of-bounds memory read. This can expose kernel memory contents through the driver's sysfs interface, potentially revealing sensitive system information.
Technical details
The vulnerability is an out-of-bounds read in the HID Roccat Kone driver (hid-roccat-kone.c). The functions kone_keep_values_up_to_date() and kone_profile_activated() use an 8-bit device-supplied profile index directly as an array subscript into a 5-element profiles[] array without range checking. A malicious USB device can send a switch-profile event (or startup_profile value at probe time) with an out-of-range value (e.g., > 5), causing the driver to read beyond the allocated buffer. The leaked memory is exposed via the actual_dpi sysfs attribute. The fix adds explicit range validation (1 ≤ profile ≤ ARRAY_SIZE) before array access, with a fallback to profile 1 if invalid.
Affected products
- Linux kernel all versions with Roccat Kone driver support
Timeline
- 2026-09-17: disclosed: Published by NVD
- 2026-06-29: patched: Upstream kernel patch merged
- 2026-09-14: patched: Patch applied to stable kernel releases