CVE-2026-93188 - Vulnerability Details

- HID: roccat: bound device-supplied profile index

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: roccat: bound device-supplied profile index

kone_keep_values_up_to_date() and kone_profile_activated() use an
8-bit, device-supplied profile value as an index into the 5-element
kone->profiles[] array without a range check. A malicious USB device
claiming the Roccat Kone id can send a switch-profile event (or a
startup_profile read at probe) with an out-of-range value and make the
driver read out of bounds; the result is exposed via the actual_dpi
sysfs attribute.

Reject out-of-range indices in both paths.

This was found with static analysis and confirmed with the KUnit test
added in the following patch (KASAN: slab-out-of-bounds).

Published: 2026-09-17

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A malicious USB HID device claiming the Roccat Kone identifier can supply an 8‑bit profile index that exceeds the 5‑element array maintained by the driver. The driver uses the value as an array index in two code paths without a bounds check, causing an out‑of‑bounds read. The data read is exposed through the actual_dpi sysfs attribute, allowing an attacker to learn DPI settings for the mouse and potentially other internal state. This vulnerability is an out‑of‑bounds read that can leak sensitive information.

Affected Systems

The flaw exists in the Linux kernel’s Roccat HID driver for the Kone mouse and affects all kernel releases that include the unpatched driver. No specific version range is listed, so all kernels prior to the patch are potentially impacted.

Risk and Exploitability

The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability that it will be actively exploited. The attack requires a physical USB device that can emulate a Roccat Kone and requires the device to be connected to a Linux system. Although the exploitation can read data from a sysfs file, the overall risk is modest until a patch is applied.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`14bf62cde79423a02a590e02664ed29a36facec1`	affected	< 686e5c3bd378933b4e795fcc7d40c5aad358eaaa
`14bf62cde79423a02a590e02664ed29a36facec1`	affected	< 0a139188a7ce4baab7acc5d60e0d1c8657f9b4d4
`14bf62cde79423a02a590e02664ed29a36facec1`	affected	< 67d7851f113fd0205dd27416d3c47ab32b176097
`14bf62cde79423a02a590e02664ed29a36facec1`	affected	< 4b29be4b23bc28f59def1485702887e395256e11
`14bf62cde79423a02a590e02664ed29a36facec1`	affected	< 579c78c8c317ecff8b6b820c227c93e6ec4e565d
`14bf62cde79423a02a590e02664ed29a36facec1`	affected	< 635914c60da26a9892f27ffb5edcc922a10effab
`14bf62cde79423a02a590e02664ed29a36facec1`	affected	< 99330b12376c3373ab555c24bc797630f03b81a2
`14bf62cde79423a02a590e02664ed29a36facec1`	affected	< 43fae42628a8c10fa8981773d7ec9f1a367821a7

Linux

affected

Version	Status	Constraints
`2.6.35`	affected	—
`0`	unaffected	< 2.6.35
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[14bf62cde79423a02a590e02664ed29a36facec1,686e5c3bd378933b4e795fcc7d40c5aad358eaaa)`	affected	code_commit	—
`[14bf62cde79423a02a590e02664ed29a36facec1,0a139188a7ce4baab7acc5d60e0d1c8657f9b4d4)`	affected	code_commit	—
`[14bf62cde79423a02a590e02664ed29a36facec1,4b29be4b23bc28f59def1485702887e395256e11)`	affected	code_commit	—
`[14bf62cde79423a02a590e02664ed29a36facec1,579c78c8c317ecff8b6b820c227c93e6ec4e565d)`	affected	code_commit	—
`[14bf62cde79423a02a590e02664ed29a36facec1,635914c60da26a9892f27ffb5edcc922a10effab)`	affected	code_commit	—
`[14bf62cde79423a02a590e02664ed29a36facec1,99330b12376c3373ab555c24bc797630f03b81a2)`	affected	code_commit	—
`[14bf62cde79423a02a590e02664ed29a36facec1,43fae42628a8c10fa8981773d7ec9f1a367821a7)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.35`	affected	semver	—
`[0,2.6.35)`	unaffected	semver	—
`[5.10.270,5.11.0)`	unaffected	semver	—
`[5.15.221,5.16.0)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.52,6.19.0)`	unaffected	semver	—
`[7.2.6,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel update that includes the roccat driver bounds‑check patch
Restrict or disconnect external HID devices until the update is installed
Monitor sysfs attributes such as /sys/class/hidraw/.../actual_dpi for unexpected values

Generated by OpenCVE AI on September 19, 2026 at 08:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00196.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0a139188a7ce4baab7acc5d60e0d1c8657f9b4d4
https://git.kernel.org/stable/c/43fae42628a8c10fa8981773d7ec9f1a367821a7
https://git.kernel.org/stable/c/4b29be4b23bc28f59def1485702887e395256e11
https://git.kernel.org/stable/c/579c78c8c317ecff8b6b820c227c93e6ec4e565d
https://git.kernel.org/stable/c/635914c60da26a9892f27ffb5edcc922a10effab
https://git.kernel.org/stable/c/67d7851f113fd0205dd27416d3c47ab32b176097
https://git.kernel.org/stable/c/686e5c3bd378933b4e795fcc7d40c5aad358eaaa
https://git.kernel.org/stable/c/99330b12376c3373ab555c24bc797630f03b81a2

History

Sat, 19 Sep 2026 08:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125 CWE-20

Thu, 17 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: HID: roccat: bound device-supplied profile index kone_keep_values_up_to_date() and kone_profile_activated() use an 8-bit, device-supplied profile value as an index into the 5-element kone->profiles[] array without a range check. A malicious USB device claiming the Roccat Kone id can send a switch-profile event (or a startup_profile read at probe) with an out-of-range value and make the driver read out of bounds; the result is exposed via the actual_dpi sysfs attribute. Reject out-of-range indices in both paths. This was found with static analysis and confirmed with the KUnit test added in the following patch (KASAN: slab-out-of-bounds).
Title		HID: roccat: bound device-supplied profile index
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0a139188a7ce4baab7acc5d60e0d1c8657f9b4d4 https://git.kernel.org/stable/c/43fae42628a8c10fa8981773d7ec9f1a367821a7 https://git.kernel.org/stable/c/4b29be4b23bc28f59def1485702887e395256e11 https://git.kernel.org/stable/c/579c78c8c317ecff8b6b820c227c93e6ec4e565d https://git.kernel.org/stable/c/635914c60da26a9892f27ffb5edcc922a10effab https://git.kernel.org/stable/c/67d7851f113fd0205dd27416d3c47ab32b176097 https://git.kernel.org/stable/c/686e5c3bd378933b4e795fcc7d40c5aad358eaaa https://git.kernel.org/stable/c/99330b12376c3373ab555c24bc797630f03b81a2

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-17T16:12:13.482Z

Updated: 2026-09-17T16:12:13.482Z

Reserved: 2026-09-17T16:02:15.091Z

Link: CVE-2026-93188

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-17T17:18:14.887

Modified: 2026-09-17T17:18:14.887

Link: CVE-2026-93188

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-20T05:00:11Z

Weaknesses

CWE-125
Out-of-bounds Read
CWE-20
Improper Input Validation

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object