CVE-2026-93188

A flaw was found in the Linux kernel's Roccat Human Interface Device (HID) driver. A local attacker, by connecting a specially crafted malicious USB device, can send an out-of-range profile index. This can lead to an out-of-bounds read, resulting in the disclosure of sensitive information through the actual_dpi sysfs attribute.

A moderate out-of-bounds read vulnerability was found in the Linux kernel's Roccat Kone HID driver, affecting Red Hat products that ship the kernel. The kone_keep_values_up_to_date() and kone_profile_activated() functions use an 8-bit, device-supplied profile value as an index into the 5-element kone->profiles[] array without a range check. An attacker who can connect a specially crafted malicious USB device claiming the Roccat Kone product ID can send an out-of-range profile index, via a switch-profile event or a startup_profile read at probe time, causing the driver to read out of bounds; the result is exposed to user space through the actual_dpi sysfs attribute. Red Hat Enterprise Linux 6 is not affected because the vulnerable code is not present in that stream. For the affected Red Hat Enterprise Linux 7 through 10 (kernel and kernel-rt), Red Hat In-Vehicle OS, and OpenShift Container Platform (RHEL CoreOS) streams, the fix is currently deferred to a future update: exploitation requires connecting a malicious USB device claiming a specific HID product ID, so the residual risk of delaying the fix is considered low.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.