{"cve":"CVE-2026-89627","nvd":{"published":"2026-09-11T20:19:48.153","modified":"2026-10-19T09:17:59.600","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: roccat: free buffered reports when destroying device\n\nroccat_report_event() duplicates each report with kmemdup() and stores\nthe allocation in a circular-buffer slot. The allocation is released only\nwhen that slot is reused.\n\nThe device destruction paths free struct roccat_device without releasing\nreports still stored in cbuf[]. This makes those allocations unreachable\nand leaks up to ROCCAT_CBUF_SIZE report buffers per device.\n\nAdd a small destructor that frees every buffered report before freeing the\ndevice, and use it in both paths that can destroy a registered device.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/4cb3ff31d237ad1f515455c497ef07d7172d912b","https://git.kernel.org/stable/c/690da9177e64bcfda2f4c0b5b8465178e4a236d8","https://git.kernel.org/stable/c/943b8dc2c6044c01e36395f51bb809a4b6bdfd22","https://git.kernel.org/stable/c/b3cc411daa50b39ba5706492a80a5a0804d9c85f","https://git.kernel.org/stable/c/bbff0ccbff360a5498075525005f6a913239a3d7"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:53:43.293028046+00:00"},"epss":{"cve":"CVE-2026-89627","score":0.00216,"percentile":0.11976,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}