In the Linux kernel, the roccat HID driver duplicates each incoming report using kmemdup() and records the copy in a circular buffer. The allocation is released only when that buffer slot is reused. When a roccat device is destroyed, the code frees the device structure but does not free the reports still stored in the circular buffer. This leaves up to ROCCAT_CBUF_SIZE report buffers per device unreachable, causing memory leaks that can exhaust system memory, degrade performance, or trigger a denial‑of‑service. The flaw is a classic memory leak due to improper resource release.

Affected systems are Linux kernel distributions that include the roccat HID driver. All mainstream Linux kernel variants that bundle the roccat driver before the destructor fix are potentially impacted. The vendor information shows Linux:Linux, indicating a broad scope; however, specific kernel versions are not provided, so administrators should verify whether their kernel build loads the roccat driver and whether the fix is present Linux kernel, the roccat HID driver duplicates each incoming report using kmemdup() and stores the copies in a circular buffer. When a roccat device is destroyed, the original code frees the device structure but leaves the buffered report allocations in the circular buffer untouched, creating memory leaks of up to ROCCAT_CBUF_SIZE report buffers per device. The resulting heap exhaustion can degrade system performance or cause a denial‑of‑service. This flaw maps to CWE‑772 (Memory Leak due to Improper Release).

The CVSS score of 3.3 and EPSS score of less than 1% indicate low severity and very low exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker must have local or kernel‑level privileges to unload or reset the roccat device, or otherwise force the driver to destroy the device. Therefore the primary attack vector is local access with privileged operations, and the risk is largely limited to environments where such actions are possible. The potential for memory exhaustion exists, but the utility of the exploit is constrained by the required access level.