In the Linux kernel, the following vulnerability has been resolved: HID: roccat: bound device-supplied profile index kone_keep_values_up_to_date() and kone_profile_activated() use an 8-bit, device-supplied profile value as an index into the 5-element kone->profiles[] array without a range check. A malicious USB device claiming the Roccat Kone id can send a switch-profile event (or a startup_profile read at probe) with an out-of-range value and make the driver read out of bounds; the result is exposed via the actual_dpi sysfs attribute. Reject out-of-range indices in both paths. This was found with static analysis and confirmed with the KUnit test added in the following patch (KASAN: slab-out-of-bounds).
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 2
- StatusReceived → PublishedNVD modified 2026-10-19 09:07
- First seenunscoredNVD modified 2026-10-19 10:17
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 8
- https://git.kernel.org/stable/c/0a139188a7ce4baab7acc5d60e0d1c8657f9b4d4
- https://git.kernel.org/stable/c/43fae42628a8c10fa8981773d7ec9f1a367821a7
- https://git.kernel.org/stable/c/4b29be4b23bc28f59def1485702887e395256e11
- https://git.kernel.org/stable/c/579c78c8c317ecff8b6b820c227c93e6ec4e565d
- https://git.kernel.org/stable/c/635914c60da26a9892f27ffb5edcc922a10effab
- https://git.kernel.org/stable/c/67d7851f113fd0205dd27416d3c47ab32b176097
- https://git.kernel.org/stable/c/686e5c3bd378933b4e795fcc7d40c5aad358eaaa
- https://git.kernel.org/stable/c/99330b12376c3373ab555c24bc797630f03b81a2