CVE-2026-43111

Summary

In the Linux kernel, the following vulnerability has been resolved:

HID: roccat: fix use-after-free in roccat_report_event

roccat_report_event() iterates over the device->readers list without holding the readers_lock. This allows a concurrent roccat_release() to remove and free a reader while it's still being accessed, leading to a use-after-free.

Protect the readers list traversal with the readers_lock mutex.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < 20dca865460f7943cf70afca274b60dac371f546affected
LinuxLinux206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < 441689e3103694caa3e2d62b7d57c7bccefa5e37affected
LinuxLinux206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < 181ea51ab0f6370842c5b49cfb86824253a1189eaffected
LinuxLinux206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < e6a445513fbc6a0329d2d5ff375b6725750ec5a6affected
LinuxLinux206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < e16a6d11bd77b81632165f02cf0d5946df74b3b7affected
LinuxLinux206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < 36bb2d0b915014bbdc5044982b31b57b78045b93affected
LinuxLinux206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < bca0b595e15450dd66b1153c76c4ef1087ee011baffected
LinuxLinux206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 < d802d848308b35220f21a8025352f0c0aba15c12affected
LinuxLinux2.6.35affected
LinuxLinux0 < 2.6.35unaffected
LinuxLinux5.10.258 <= 5.10.*unaffected
LinuxLinux5.15.209 <= 5.15.*unaffected
LinuxLinux6.1.175 <= 6.1.*unaffected
LinuxLinux6.6.136 <= 6.6.*unaffected
LinuxLinux6.12.83 <= 6.12.*unaffected
LinuxLinux6.18.24 <= 6.18.*unaffected
LinuxLinux6.19.14 <= 6.19.*unaffected
LinuxLinux7.0 <= *unaffected

Weaknesses

References