CVE-2022-41850: Linux Kernel Use-After-Free Vulnerability

CVE-2022-41850 Overview

CVE-2022-41850 is a race condition vulnerability in the Linux kernel HID Roccat driver. The flaw exists in the roccat_report_event function within drivers/hid/hid-roccat.c and affects Linux kernel versions through 5.19.12. The race condition leads to a use-after-free when a new report is received while the kernel is still copying report->value from a prior event. The defect is tracked under CWE-362 and primarily impacts system availability through kernel memory corruption. Debian Linux distributions shipping affected kernel packages are also impacted.

Critical Impact
A local authenticated attacker can trigger a use-after-free in the Roccat HID driver, leading to kernel memory corruption and denial of service on affected Linux systems.

Affected Products

Linux Kernel versions up to and including 5.19.12
Debian Linux 10.0 (with affected kernel packages)
Distributions shipping the hid-roccat driver module

Discovery Timeline

2022-09-30 - CVE-2022-41850 published to the National Vulnerability Database (NVD)
2022-12 - Debian LTS issues advisories referencing the fix (see Debian LTS Announcement #31 and Debian LTS Announcement #34)
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-41850

Vulnerability Analysis

The vulnerability resides in the Roccat HID driver, which exposes Roccat gaming peripherals to userspace through a character device. The roccat_report_event function is invoked from the HID interrupt path when the device sends a report. The function copies report data into per-reader buffers so that userspace processes blocked on read() can retrieve it.

The race condition occurs when one execution context is copying the contents of a previously stored report->value while another context, driven by a newly arriving device report, frees or overwrites that same buffer. The result is a use-after-free on kernel memory that was assumed to remain valid for the duration of the copy.

Because exploitation requires local access, a valid user session, and the ability to interact with a Roccat-class device, the attack complexity is high. Successful triggering corrupts kernel state and typically results in a kernel oops or panic, breaking system availability.

Root Cause

The root cause is insufficient synchronization between the report-reception path and the report-consumption path inside drivers/hid/hid-roccat.c. Reference counting and locking around the report->value buffer did not cover the full window during which the buffer was read. The upstream fix, committed as cacdb14b1c8d3804a3a7d31773bc7569837b71a4, restructures the data handling so the buffer cannot be released while a copy is in flight. See the Linux Kernel Commit Note for the patch.

Attack Vector

An attacker must have local access and be able to open the Roccat character device, typically /dev/hidraw* or the Roccat-specific node, while a physical or emulated Roccat HID device generates reports. By racing concurrent reads with incoming reports, the attacker can induce the use-after-free condition. The vulnerability does not yield code execution or information disclosure under its assigned vector and is scoped to denial of service. Public discussion of the issue is available on the Kernel Mailing List.

Detection Methods for CVE-2022-41850

Indicators of Compromise

Kernel oops or panic messages referencing roccat_report_event, hid-roccat, or report->value in dmesg and /var/log/kern.log.
KASAN (Kernel Address Sanitizer) reports flagging use-after-free in the HID Roccat code path on instrumented kernels.
Unexpected process crashes for userspace daemons reading from Roccat HID character devices.

Detection Strategies

Inventory running kernels against the patched versions identified in vendor advisories and flag hosts still running linux_kernel builds at or below 5.19.12 without the backport.
Monitor loaded kernel modules for hid_roccat on systems where Roccat peripherals are not expected, since the module is only relevant where such hardware is present.
Correlate kernel crash telemetry with HID subsystem activity to identify repeated faults that align with the race window.

Monitoring Recommendations

Forward dmesg and kernel ring buffer events to a centralized logging or SIEM pipeline and alert on BUG: KASAN, general protection fault, or Oops strings referencing HID driver symbols.
Track package versions for linux-image-* across the fleet and alert when hosts drift from the patched baseline.
Audit which local accounts have access to HID character device nodes and review udev rules granting non-root users access to Roccat devices.

How to Mitigate CVE-2022-41850

Immediate Actions Required

Apply the Linux kernel update that includes commit cacdb14b1c8d3804a3a7d31773bc7569837b71a4 or the distribution backport that references CVE-2022-41850.
On Debian systems, install the kernel updates published in the Debian LTS Announcement #31 and Debian LTS Announcement #34 advisories.
Reboot affected hosts after patching to ensure the vulnerable kernel image is no longer in memory.

Patch Information

The upstream fix is available in the Linux kernel mainline as commit cacdb14b1c8d3804a3a7d31773bc7569837b71a4. Stable and long-term branches received backports, and Debian shipped corresponding linux-image package updates through its LTS advisory channel. Administrators should align their kernel package version with the fix referenced in their distribution's security tracker.

Workarounds

Blacklist the hid_roccat module on systems that do not require Roccat peripheral support by adding blacklist hid_roccat to a file under /etc/modprobe.d/ and rebuilding the initramfs.
Restrict access to HID character device nodes so that only trusted local accounts can open them, reducing the population of users able to drive the race.
Physically disconnect or disallow Roccat HID devices on multi-user systems until the kernel patch is applied.

bash

# Configuration example: disable the vulnerable driver until patching completes
echo "blacklist hid_roccat" | sudo tee /etc/modprobe.d/disable-hid-roccat.conf
sudo update-initramfs -u
sudo reboot