CVE-2026-93188: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-93188 is an out-of-bounds read vulnerability in the Linux kernel's HID roccat driver affecting the Roccat Kone device handler. The functions kone_keep_values_up_to_date() and kone_profile_activated() use an 8-bit, device-supplied profile index to access the 5-element kone->profiles[] array without performing a range check, allowing a malicious USB device to trigger a slab-out-of-bounds read. The vulnerability affects Linux kernel versions from 2.6.35 up to (but not including) the fixed stable releases. Fixed versions include 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6, and 7.3-rc1. The CVSS base score is currently listed as 0.0 (Medium estimate), and the CVE was published on September 17, 2026 (GitHub Advisory, Feedly).

The root cause is a missing bounds check (CWE-125: Out-of-bounds Read) in the Linux kernel's drivers/hid/hid-roccat-kone.c. When a USB device sends a switch-profile HID event or when startup_profile is read during device probe, the driver uses the raw 8-bit value supplied by the device as a direct index into the 5-element kone->profiles[] array. Since no validation is performed, an attacker controlling a USB device that presents the Roccat Kone vendor/product ID can supply an index value of 5–255, causing the kernel to read memory beyond the array boundary. The out-of-bounds data is subsequently exposed to unprivileged users via the actual_dpi sysfs attribute. The vulnerability was discovered through static analysis and confirmed with a KUnit test triggering a KASAN slab-out-of-bounds report (GitHub Advisory).

Successful exploitation allows an attacker with physical access and a malicious USB device to cause the Linux kernel to read memory outside the bounds of the kone->profiles[] array, with the leaked kernel memory contents exposed through the actual_dpi sysfs attribute readable by local users. This constitutes a kernel memory disclosure (confidentiality impact), potentially revealing sensitive data such as kernel pointers or heap contents that could aid in further exploitation. Integrity and availability are not directly impacted by this vulnerability in its current form (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. Exploitation requires physical access to plug in a specially crafted USB device that spoofs the Roccat Kone product ID, significantly limiting the attack surface. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly, GitHub Advisory).

1. Prepare malicious USB device: Program a USB microcontroller (e.g., using a Raspberry Pi Zero or BadUSB-capable device) to enumerate as a HID device with the Roccat Kone vendor ID and product ID.
2. Craft out-of-range profile event: Configure the device firmware to send a HID switch-profile event or respond to a startup_profile read with a profile index value greater than 4 (e.g., 0xFF) to exceed the 5-element kone->profiles[] array bounds.
3. Connect to target system: Plug the malicious USB device into a Linux system running a vulnerable kernel version (2.6.35 through the unpatched stable branches).
4. Trigger the out-of-bounds read: The kernel HID roccat driver processes the device event and uses the out-of-range index to read beyond the profiles[] array in kernel heap memory.
5. Read leaked memory: Access the actual_dpi sysfs attribute (e.g., cat /sys/bus/usb/.../<device>/actual_dpi) to retrieve the out-of-bounds kernel memory contents, potentially disclosing kernel heap data (GitHub Advisory, Feedly).

• Physical/Hardware: Unrecognized or unexpected USB HID device appearing in lsusb output with Roccat Kone vendor/product IDs on systems where no such device is expected.
• Logs: Kernel log messages (dmesg) showing KASAN slab-out-of-bounds errors related to hid-roccat-kone or kone_keep_values_up_to_date/kone_profile_activated functions.
• File System/Sysfs: Unusual or repeated reads of /sys/bus/usb/.../actual_dpi sysfs attribute, particularly from unprivileged processes or scripts.
• Process: Unexpected processes reading HID roccat sysfs attributes, especially shortly after a new USB device is connected.

Apply the kernel patches that add range validation for the device-supplied profile index in both kone_keep_values_up_to_date() and kone_profile_activated(). Fixed stable kernel versions are: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6, and 7.3-rc1. As a workaround where patching is not immediately possible, avoid connecting untrusted USB devices to affected systems, and consider restricting access to HID roccat sysfs attributes or blacklisting the hid-roccat-kone kernel module if Roccat Kone devices are not in use (GitHub Advisory, Feedly).