CVE-2022-41850

What it actually does

Race condition in roccat_report_event causes use-after-free when a report arrives during report->value copy in the Linux kernel HID driver.

Why it matters to the business

Local denial-of-service on Linux systems using affected Roccat HID hardware, leading to crashes that disrupt user sessions or server workloads until reboot.

How an attack unfolds

An attacker with local access to a system using a Roccat device sends HID reports concurrently with normal driver processing to trigger the race, freeing memory that is then accessed during the value copy.

How to fix it

Upgrade the Linux kernel to the fixed commit cacdb14b1c8d3804a3a7d31773bc7569837b71a4 or any later mainline version containing the patch; rebuild and reboot with the updated kernel.

How to confirm the fix worked

Verify the running kernel contains commit cacdb14b1c8d3804a3a7d31773bc7569837b71a4 via git log or version string; confirm absence of the vulnerable roccat_report_event code path.

Typical attack path

1. Obtain local user access on target Linux system
2. Ensure Roccat HID device is present and driver loaded
3. Send crafted or rapid HID reports while driver copy operation occurs
4. Trigger use-after-free resulting in kernel panic or system hang

How to detect it

Review kernel logs for oops/panic messages referencing hid-roccat.c or use-after-free in report handling; correlate with device attachment events for Roccat hardware.

What your security team should do

• Prioritize kernel updates on all systems with Roccat or similar HID devices
• Test updated kernels in staging environments before broad rollout
• Disable unused HID drivers where possible to reduce attack surface
• Monitor vendor advisories for backported fixes in distribution kernels