CVE-2026-93188

What it actually does

Unchecked 8-bit profile index supplied by a USB HID device is used to index a 5-element kernel array in kone_keep_values_up_to_date() and kone_profile_activated(), resulting in a slab out-of-bounds read whose value is exposed through the actual_dpi sysfs attribute.

Why it matters to the business

A malicious or compromised USB device can trigger kernel memory disclosure or a crash on affected Linux systems, potentially leading to information leakage or denial of service without any user interaction beyond device connection.

How an attack unfolds

An attacker presents a USB device that enumerates as a Roccat Kone, then sends a switch-profile event or startup_profile value containing an out-of-range index; the driver performs an unchecked array access, reading kernel memory that is later surfaced via sysfs.

How to fix it

Apply the upstream kernel patch that adds explicit range checks rejecting out-of-range profile indices in both kone_keep_values_up_to_date() and kone_profile_activated(); rebuild and deploy the updated kernel on all affected systems.

How to confirm the fix worked

Confirm the fix is present by inspecting the relevant functions for the added bounds checks, run the added KUnit test case, or verify that connecting a device supplying an out-of-range profile no longer triggers KASAN reports or exposes invalid data via actual_dpi.

Typical attack path

1. USB device claims Roccat Kone HID identity at enumeration
2. Device sends switch-profile event or startup_profile read with index >= 5
3. Driver indexes kone->profiles[] without bounds check
4. Out-of-bounds read occurs and result is written to actual_dpi sysfs file
5. Attacker reads sysfs attribute to obtain leaked kernel memory

How to detect it

Look in kernel logs for KASAN slab-out-of-bounds reports referencing roccat or kone_profile functions; inspect sysfs reads of actual_dpi immediately after unknown USB HID device attachment.

What your security team should do

• Prioritize kernel updates on any system that may accept untrusted USB HID devices
• Disable the roccat module if the hardware is not required
• Monitor for future stable kernel releases containing the patch