CVE-2026-89627

What it actually does

The Linux kernel HID Roccat driver leaks kernel memory on device teardown. HID reports are duplicated with kmemdup() into a circular buffer and are freed only when a slot is reused; destruction of struct roccat_device does not release remaining cbuf[] allocations. Each destroyed device can leak up to ROCCAT_CBUF_SIZE report buffers of unreclaimable kernel memory, enabling local resource exhaustion (DoS) rather than code execution or privilege escalation.

Why it matters to the business

Operational impact is narrow: only Linux systems that load the Roccat HID driver (typically gaming mice/keyboards) are in scope. Repeated plug/unplug or bind/unbind cycles can slowly grow kernel memory use and, in extreme churn, degrade performance or crash the host. The issue is not in CISA KEV, is not associated with ransomware, has no known exploit maturity, and is about 38 days old—treat as routine kernel hygiene except where Roccat devices are common on Linux workstations, kiosks, or labs. No downstream package prevalence or named threat actors were supplied.

How an attack unfolds

This is a local denial-of-service memory leak, not remote code execution. An attacker who can register a Roccat HID device and then destroy it—by physically attaching and removing compatible or spoofed USB HID hardware, or by forcing driver bind/unbind—leaves duplicated report buffers unreachable because they are never reused. Repeating that cycle accumulates slab allocations until the kernel is under memory pressure, which can cause allocation failures, the OOM killer, or instability. No public exploit activity, named APT groups, or ransomware campaigns are associated with this flaw.

How to fix it

Apply the upstream Linux kernel fix that adds a destructor to free every buffered report in cbuf[] before freeing struct roccat_device, and that uses it on both registered-device destruction paths. Upgrade to a distribution kernel that includes the HID roccat 'free buffered reports when destroying device' change. Exact fixed package versions were not provided; follow distro security advisories and kernel changelogs. Temporary mitigation: if Roccat peripherals are not required, blacklist or unload the Roccat HID driver so the leak path cannot run.

How to confirm the fix worked

Confirm the running kernel changelog or source contains the Roccat destructor that frees buffered reports on device destruction. Verify with your distribution that the installed kernel package includes that HID: roccat fix. On hosts that do not need the hardware, confirm Roccat HID modules are not loaded. After patching, register-then-destroy cycles for a Roccat device should not leave growing kmalloc/slab usage attributable to leftover report buffers.

Typical attack path

1. Gain local or physical access sufficient to present or control a Roccat-class HID device on a vulnerable Linux kernel
2. Cause HID reports to be queued so the driver duplicates them into the circular buffer
3. Trigger device destruction (unplug, unbind, or driver teardown) so remaining buffered reports are never reused and never freed
4. Repeat register/destroy cycles to grow unreclaimable kernel allocations
5. Induce or wait for kernel memory exhaustion resulting in denial of service

How to detect it

There are no reliable network or malware-style artifacts. Hunt for kernel memory growth correlated with Roccat HID connect/disconnect, USB attach/removal of Roccat-class devices, hid-roccat module load/unload, and OOM-killer or slab-pressure events on Linux desktops. Review dmesg and journal HID/USB logs around device destruction. Because exploit maturity is none and no threat actors are named, historical compromise is unlikely; focus on exposure (driver loaded, unpatched kernel) rather than assuming prior exploitation.

What your security team should do

• Inventory Linux hosts that use Roccat HID gaming peripherals and patch those kernels first
• Treat remaining Linux fleets as standard kernel-update hygiene; this is not KEV and has no known in-the-wild exploitation
• If patching is delayed, blacklist the Roccat HID driver wherever those devices are not required
• Watch kernel memory (slab/kmalloc) and OOM events on Linux desktops with high USB attach/detach churn
• Track distribution kernel advisories for the HID roccat buffered-report free fix until exact package versions are published