CVE-2026-43111

HID: roccat: fix use-after-free in roccat_report_event

State: Published
Severity: 7.8 High
Published: May 6, 2026
Updated: Oct 19, 2026
Reserved: May 1, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: roccat: fix use-after-free in roccat_report_event

roccat_report_event() iterates over the device->readers list without holding the readers_lock. This allows a concurrent roccat_release() to remove and free a reader while it's still being accessed, leading to a use-after-free.

Protect the readers list traversal with the readers_lock mutex.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 to before 20dca865460f7943cf70afca274b60dac371f546Affected 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 to before 441689e3103694caa3e2d62b7d57c7bccefa5e37Affected 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 to before 181ea51ab0f6370842c5b49cfb86824253a1189eAffected 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 to before e6a445513fbc6a0329d2d5ff375b6725750ec5a6Affected 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 to before e16a6d11bd77b81632165f02cf0d5946df74b3b7Affected 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 to before 36bb2d0b915014bbdc5044982b31b57b78045b93Affected 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 to before bca0b595e15450dd66b1153c76c4ef1087ee011bAffected 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 to before d802d848308b35220f21a8025352f0c0aba15c12Affected
LinuxLinux	2.6.35Affected before 2.6.35Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.136 through 6.6.Not affected 6.12.83 through 6.12.Not affected 6.18.24 through 6.18.Not affected 6.19.14 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 to before 20dca865460f7943cf70afca274b60dac371f546Affected
206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 to before 441689e3103694caa3e2d62b7d57c7bccefa5e37Affected
206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 to before 181ea51ab0f6370842c5b49cfb86824253a1189eAffected
206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 to before e6a445513fbc6a0329d2d5ff375b6725750ec5a6Affected
206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 to before e16a6d11bd77b81632165f02cf0d5946df74b3b7Affected
206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 to before 36bb2d0b915014bbdc5044982b31b57b78045b93Affected
206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 to before bca0b595e15450dd66b1153c76c4ef1087ee011bAffected
206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 to before d802d848308b35220f21a8025352f0c0aba15c12Affected

LinuxLinux

2.6.35Affected
before 2.6.35Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.136 through 6.6.*Not affected
6.12.83 through 6.12.*Not affected
6.18.24 through 6.18.*Not affected
6.19.14 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.