{"id":"CVE-2026-89627","title":"HID: roccat: free buffered reports when destroying device","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: roccat: free buffered reports when destroying device\n\nroccat_report_event() duplicates each report with kmemdup() and stores\nthe allocation in a circular-buffer sl…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-772"],"vendor":"Linux","product":"Linux","affected":["Linux >= 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < cebb20b9a29cfc90bf56e54337333084f85a69dd","Linux >= 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < 690da9177e64bcfda2f4c0b5b8465178e4a236d8","Linux >= 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < b3cc411daa50b39ba5706492a80a5a0804d9c85f","Linux >= 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < 4cb3ff31d237ad1f515455c497ef07d7172d912b","Linux >= 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < 943b8dc2c6044c01e36395f51bb809a4b6bdfd22","Linux >= 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < da00eac19feef209c9591e48c860afc2014603be","Linux >= 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < fbb5a60f5c31b5625f0d89a79912fbcb2559289b","Linux >= 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < bbff0ccbff360a5498075525005f6a913239a3d7","Linux 2.6.35"],"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:49:59.521Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89627","references":[{"url":"https://git.kernel.org/stable/c/cebb20b9a29cfc90bf56e54337333084f85a69dd"},{"url":"https://git.kernel.org/stable/c/690da9177e64bcfda2f4c0b5b8465178e4a236d8"},{"url":"https://git.kernel.org/stable/c/b3cc411daa50b39ba5706492a80a5a0804d9c85f"},{"url":"https://git.kernel.org/stable/c/4cb3ff31d237ad1f515455c497ef07d7172d912b"},{"url":"https://git.kernel.org/stable/c/943b8dc2c6044c01e36395f51bb809a4b6bdfd22"},{"url":"https://git.kernel.org/stable/c/da00eac19feef209c9591e48c860afc2014603be"},{"url":"https://git.kernel.org/stable/c/fbb5a60f5c31b5625f0d89a79912fbcb2559289b"},{"url":"https://git.kernel.org/stable/c/bbff0ccbff360a5498075525005f6a913239a3d7"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89627.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89627"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532449"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89627"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89627"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89627.mbox"}],"tags":["cve.org","csaf","vex","red-hat"],"epss":0.00216,"epssPercentile":0.12006,"ingestedAt":"2026-09-14T15:23:07.450Z","slug":"CVE-2026-89627","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nHID: roccat: free buffered reports when destroying device\n\nroccat_report_event() duplicates each report with kmemdup() and stores\nthe allocation in a circular-buffer slot. The allocation is released only\nwhen that slot is reused.\n\nThe device destruction paths free struct roccat_device without releasing\nreports still stored in cbuf[]. This makes those allocations unreachable\nand leaks up to ROCCAT_CBUF_SIZE report buffers per device.\n\nAdd a small destructor that frees every buffered report before freeing the\ndevice, and use it in both paths that can destroy a registered device.\n\n## Affected\n\n- `Linux >= 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < cebb20b9a29cfc90bf56e54337333084f85a69dd`\n- `Linux >= 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < 690da9177e64bcfda2f4c0b5b8465178e4a236d8`\n- `Linux >= 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < b3cc411daa50b39ba5706492a80a5a0804d9c85f`\n- `Linux >= 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < 4cb3ff31d237ad1f515455c497ef07d7172d912b`\n- `Linux >= 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < 943b8dc2c6044c01e36395f51bb809a4b6bdfd22`\n- `Linux >= 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < da00eac19feef209c9591e48c860afc2014603be`\n- `Linux >= 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < fbb5a60f5c31b5625f0d89a79912fbcb2559289b`\n- `Linux >= 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < bbff0ccbff360a5498075525005f6a913239a3d7`\n- `Linux 2.6.35`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89627.json)","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":203852,"id":"CVE-2026-89627","ts":1789490210154,"field":"cvss","old":null,"new":"5.5"},{"seq":203851,"id":"CVE-2026-89627","ts":1789490210154,"field":"severity","old":"none","new":"medium"},{"seq":147093,"id":"CVE-2026-89627","ts":1789270195139,"field":"cvss","old":null,"new":"3.3"},{"seq":147092,"id":"CVE-2026-89627","ts":1789270195139,"field":"severity","old":"none","new":"low"},{"seq":108846,"id":"CVE-2026-89627","ts":1789183729229,"field":"cvss","old":null,"new":"3.3"},{"seq":108845,"id":"CVE-2026-89627","ts":1789183729229,"field":"severity","old":"none","new":"low"}]}