CVE-2026-89627Medium· 5.5▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: HID: roccat: free buffered reports when destroying device roccat_report_event() duplicates each report with kmemdup() and stores the allocation in a circular-buffer sl…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
— → 3.3
none → low
— → 3.3
none → low
— → 5.5
none → medium
Last analysed / modified upstream
0.2% → 0.2%
In the Linux kernel, the following vulnerability has been resolved:
HID: roccat: free buffered reports when destroying device
roccat_report_event() duplicates each report with kmemdup() and stores the allocation in a circular-buffer slot. The allocation is released only when that slot is reused.
The device destruction paths free struct roccat_device without releasing reports still stored in cbuf[]. This makes those allocations unreachable and leaks up to ROCCAT_CBUF_SIZE report buffers per device.
Add a small destructor that frees every buffered report before freeing the device, and use it in both paths that can destroy a registered device.
Linux >= 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < cebb20b9a29cfc90bf56e54337333084f85a69ddLinux >= 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < 690da9177e64bcfda2f4c0b5b8465178e4a236d8Linux >= 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < b3cc411daa50b39ba5706492a80a5a0804d9c85fLinux >= 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < 4cb3ff31d237ad1f515455c497ef07d7172d912bLinux >= 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < 943b8dc2c6044c01e36395f51bb809a4b6bdfd22Linux >= 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < da00eac19feef209c9591e48c860afc2014603beLinux >= 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < fbb5a60f5c31b5625f0d89a79912fbcb2559289bLinux >= 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < bbff0ccbff360a5498075525005f6a913239a3d7Linux 2.6.35Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-100071Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: net: hsr: free learned nodes on device setup failure hsr_dev_finalize() can fail after a lower-device RX handler has already been registered (slave A is added before t…
CVE-2024-57804High· 7.3scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs
CVE-2024-47794High· 7.8bpf: Prevent tailcall infinite loop caused by freplace
CVE-2026-100070Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet sashiko says: If map_addr() changes the packet length, such as when the public NAT IP string is shor…
CVE-2025-39977High· 7.8In the Linux kernel, the following vulnerability has been resolved: futex: Prevent use-after-free during requeue-PI syzbot managed to trigger the following race: T1 T2 futex_wait_requeue_pi() fute…
CVE-2026-99118Nonedrm/i915/dmc: Harden DMC firmware payload parsing