In the Linux kernel, the following vulnerability has been resolved: HID: roccat: free buffered reports when destroying device roccat_report_event() duplicates each report with kmemdup() and stores the allocation in a circular-buffer slot. The allocation is released only when that slot is reused. The device destruction paths free struct roccat_device without releasing reports still stored in cbuf[]. This makes those allocations unreachable and leaks up to ROCCAT_CBUF_SIZE report buffers per device. Add a small destructor that frees every buffered report before freeing the device, and use it in both paths that can destroy a registered device.

A flaw was found in the Linux kernel's HID (Human Interface Device) roccat driver. When a roccat device is destroyed, the driver fails to properly free buffered reports, leading to a memory leak. A local attacker could potentially exploit this to exhaust system memory, resulting in a Denial of Service (DoS).

Red Hat Enterprise Linux 10 Fix deferred kernel Red Hat Enterprise Linux 10 Fix deferred kernel-rt Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Fix deferred kernel Red Hat Enterprise Linux 7 Fix deferred kernel-rt Red Hat Enterprise Linux 8 Fix deferred kernel Red Hat Enterprise Linux 8 Fix deferred kernel-rt Red Hat Enterprise Linux 9 Fix deferred kernel Red Hat Enterprise Linux 9 Fix deferred kernel-rt Red Hat OpenShift Container Platform 4 Fix deferred openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Fix deferred openshift/ose-rhel-coreos-9 https://www.cve.org/CVERecord?id=CVE-2026-89627 https://nvd.nist.gov/vuln/detail/CVE-2026-89627 https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89627.mbox