CVE-2026-93188

Overview

A Linux kernel HID driver for Roccat devices can read beyond the bounds of its profile array when a malicious USB device supplies an out‑of‑range profile index. The out‑of‑bounds read leaks the device’s DPI setting via the actual_dpi sysfs attribute, potentially exposing configuration details.

Description

In the Linux kernel, the following vulnerability has been resolved: HID: roccat: bound device-supplied profile index kone_keep_values_up_to_date() and kone_profile_activated() use an 8-bit, device-supplied profile value as an index into the 5-element kone->profiles[] array without a range check. A malicious USB device claiming the Roccat Kone id can send a switch-profile event (or a startup_profile read at probe) with an out-of-range value and make the driver read out of bounds; the result is exposed via the actual_dpi sysfs attribute. Reject out-of-range indices in both paths. This was found with static analysis and confirmed with the KUnit test added in the following patch (KASAN: slab-out-of-bounds).

Impact

{'confidentiality': 'Potential disclosure of DPI configuration via sysfs.', 'integrity': 'No direct modification of kernel data, but the driver’s state may be corrupted if repeated.', 'availability': 'No direct crash reported, but repeated exploitation could lead to kernel instability or denial of service.'}

Remediation

['Upgrade the kernel to a version that includes the patch for CVE‑2026‑93188.', 'If upgrading is not immediately possible, blacklist or unload the `roccat` HID driver using `modprobe -r roccat` or adding `blacklist roccat` to `/etc/modprobe.d/blacklist.conf`.', 'Restrict USB device access by implementing USB device filtering (e.g., using `udev` rules or the `usbguard` framework) to allow only trusted Roccat devices.', 'Enable kernel KASAN or other memory safety checks to detect similar out‑of‑bounds accesses during testing.', 'Monitor system logs for KASAN or kernel panic messages that indicate out‑of‑bounds reads.']

Risk context

High severity (CVSS 7.1) with potential for information disclosure. While no remote code execution is reported, the vulnerability could be leveraged to gain insight into device configuration. Prompt patching or driver disabling is recommended to mitigate the risk.

Affected products

• Linux kernel
• Roccat HID driver
• Roccat Kone
• Linux kernel HID roccat
• Linux kernel 6.x
• Linux kernel 5.x