CVE-2026-89627

In the Linux kernel, the following vulnerability has been resolved: HID: roccat: free buffered reports when destroying device roccat_report_event() duplicates each report with kmemdup() and stores the allocation in a circular-buffer slot. The allocation is released only when that slot is reused. The device destruction paths free struct roccat_device without releasing reports still stored in cbuf[]. This makes those allocations unreachable and leaks up to ROCCAT_CBUF_SIZE report buffers per device. Add a small destructor that frees every buffered report before freeing the device, and use it in both paths that can destroy a registered device.

EPSS

0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-25)

Published

2026-09-11

Modified

2026-10-19

Record from

the NVD, synced 2026-10-19

References

• https://git.kernel.org/stable/c/4cb3ff31d237ad1f515455c497ef07d7172d912b
• https://git.kernel.org/stable/c/690da9177e64bcfda2f4c0b5b8465178e4a236d8
• https://git.kernel.org/stable/c/943b8dc2c6044c01e36395f51bb809a4b6bdfd22
• https://git.kernel.org/stable/c/b3cc411daa50b39ba5706492a80a5a0804d9c85f
• https://git.kernel.org/stable/c/bbff0ccbff360a5498075525005f6a913239a3d7

Check your stackJSON