CVE-2026-93188

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

HID: roccat: bound device-supplied profile index

kone_keep_values_up_to_date() and kone_profile_activated() use an

8-bit, device-supplied profile value as an index into the 5-element

kone->profiles[] array without a range check. A malicious USB device

claiming the Roccat Kone id can send a switch-profile event (or a

startup_profile read at probe) with an out-of-range value and make the

driver read out of bounds; the result is exposed via the actual_dpi

sysfs attribute.

Reject out-of-range indices in both paths.

This was found with static analysis and confirmed with the KUnit test

added in the following patch (KASAN: slab-out-of-bounds).

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References