The vulnerability originates from the HID roccat driver in the Linux kernel. The function roccat_report_event() walks the device->readers list without protecting it with readers_lock, a weakness that falls under CWE-820 which involves improper synchronization, and also leads to memory corruption due to use‑after‑free (CWE-416). As a result, a concurrent roccat_release() can free an entry while it remains in use, causing a use‑after‑free that can corrupt kernel memory or enable arbitrary code execution at the kernel level.

This flaw affects systems that run the Linux kernel and load the roccat HID driver. The specific kernel version range is not enumerated in the advisory; any kernel that includes the roccat driver without the patch is vulnerable. Users running a kernel that has been updated with the commit that protects readers_lock are not affected.

The EPSS score is < 1% and the vulnerability is not listed in CISA KEV, indicating limited or unknown exploitation activity. The CVSS score is 7.8; however, a use‑after‑free in the kernel can lead to local privilege escalation or complete system compromise if an attacker with local access can trigger the race condition. The attack vector likely requires local privileges or the ability to manipulate the roccat device; a remote attacker would need to control the device itself. Because the kernel patch is required, the likelihood of exploitation decreases once the kernel is updated.