CVE-2026-89627 HID: roccat: free buffered reports when destroying device
A memory leak in the Linux kernel's Roccat HID driver allows local attackers to exhaust system memory by repeatedly connecting and disconnecting devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89627?
CVE-2026-89627 is a memory corruption vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
HID: roccat: free buffered reports when destroying device
roccat_report_event() duplicates each report with kmemdup() and stores the allocation in a circular-buffer slot. The allocation is released only when that slot is reused.
The device destruction paths free struct roccat_device without releasing reports still stored in cbuf[]. This makes those allocations unreachable and leaks up to ROCCAT_CBUF_SIZE report buffers per device.
Add a small destructor that frees every buffered report before freeing the device, and use it in both paths that can destroy a registered device.
Which versions are affected by CVE-2026-89627?
How do I fix CVE-2026-89627?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-89627 being exploited?
There is no known exploitation of CVE-2026-89627 in the wild and no public exploit code.
Sources
Also known as AZL-100359, BELL-CVE-2026-89627, DEBIAN-CVE-2026-89627, GHSA-v9hj-cvcm-4mj3, UBUNTU-CVE-2026-89627.