CVE-2026-43111: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43111 Overview

CVE-2026-43111 is a use-after-free vulnerability in the Linux kernel's HID Roccat driver. The flaw exists in the roccat_report_event() function, which iterates over the device->readers list without holding the readers_lock mutex. A concurrent call to roccat_release() can remove and free a reader while it remains in use, producing a use-after-free condition [CWE-416].

The vulnerability affects systems running the Linux kernel with the Roccat HID driver enabled, typically present where Roccat gaming peripherals are supported. Exploitation requires local access and the ability to interact with the Roccat character device, but successful triggering can corrupt kernel memory.

Critical Impact

Concurrent access to a freed reader structure can cause kernel memory corruption, denial of service, or potential local privilege escalation on systems exposing the Roccat HID device.

Affected Products

• Linux kernel HID subsystem (Roccat driver)
• Distributions shipping unpatched mainline and stable kernels
• Systems with Roccat gaming peripherals where the hid-roccat module is loaded

Discovery Timeline

• 2026-05-06 - CVE-2026-43111 published to NVD
• 2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43111

Vulnerability Analysis

The Linux kernel HID Roccat driver maintains a per-device list of readers representing user-space consumers of input reports. The roccat_report_event() function dispatches new reports to each reader on the list. The function walked the list without acquiring the readers_lock mutex that protects list membership.

When a user-space process closes its file descriptor, roccat_release() runs and removes the corresponding reader from the list before freeing it. If roccat_report_event() is iterating concurrently, it can dereference a reader pointer that roccat_release() has already freed. The result is a classic read or write to freed kernel memory.

The upstream fix protects the list traversal in roccat_report_event() by acquiring readers_lock, mirroring the locking discipline used by other paths that mutate the list. This ensures roccat_release() cannot remove or free a reader while a report is being delivered.

Root Cause

The root cause is missing synchronization between a list reader and a list writer. roccat_report_event() traversed device->readers without the mutex that roccat_release() uses when removing entries. The data race violates the locking invariant of the readers list and exposes freed memory to concurrent access.

Attack Vector

A local attacker with permission to open the Roccat character device can race report delivery against descriptor close to trigger the use-after-free. The required conditions involve concurrent activity on two threads: one generating HID reports through the device and one closing a reader file descriptor. Reliable exploitation depends on kernel allocator behavior and timing, but the resulting memory corruption can be leveraged for denial of service or, with additional primitives, privilege escalation.

No verified public exploit code is available. Technical details are documented in the upstream Linux kernel commits referenced below.

• Linux Kernel Commit 36bb2d0
• Linux Kernel Commit bca0b59
• Linux Kernel Commit d802d84
• Linux Kernel Commit e16a6d1
• Linux Kernel Commit e6a4455

Detection Methods for CVE-2026-43111

Indicators of Compromise

• Kernel oops or panic messages referencing roccat_report_event or hid-roccat in dmesg or /var/log/kern.log
• KASAN reports flagging use-after-free in the hid-roccat module on instrumented kernels
• Unexpected crashes of processes interacting with /dev/roccat* character devices

Detection Strategies

• Enable CONFIG_KASAN on test kernels to surface use-after-free reads and writes during fuzzing of the Roccat device
• Monitor kernel ring buffer output for stack traces involving hid-roccat symbols
• Audit loaded kernel modules to identify hosts where hid_roccat is present and assess exposure

Monitoring Recommendations

• Collect and centralize kernel logs to detect repeated faults in HID drivers across the fleet
• Track kernel package versions on Linux endpoints and alert on hosts running pre-fix kernel builds
• Watch for unusual local processes opening /dev/roccat* interfaces outside expected gaming or peripheral configuration tools

How to Mitigate CVE-2026-43111

Immediate Actions Required

• Update affected systems to a Linux kernel version that includes the upstream fix from the referenced stable commits
• Identify hosts where the hid_roccat module is loaded using lsmod | grep roccat and prioritize patching
• On systems that do not require Roccat hardware support, blacklist the hid_roccat module to remove the attack surface

Patch Information

The vulnerability is resolved by acquiring readers_lock in roccat_report_event() before iterating the readers list. The fix is distributed across multiple stable branches in commits 36bb2d0, bca0b59, d802d84, e16a6d1, and e6a4455. Apply distribution kernel updates that incorporate these commits or rebuild from a patched stable tree.

Workarounds

• Unload the driver with modprobe -r hid_roccat on systems that do not need Roccat peripheral support
• Restrict access to /dev/roccat* device nodes via udev rules so only trusted users and groups can open them
• Disable automatic loading by adding blacklist hid_roccat to /etc/modprobe.d/blacklist-roccat.conf until patching is complete

# Configuration example
# Verify whether the vulnerable module is loaded
lsmod | grep hid_roccat

# Prevent the module from loading until patches are applied
echo "blacklist hid_roccat" | sudo tee /etc/modprobe.d/blacklist-roccat.conf
sudo modprobe -r hid_roccat

# After patching, confirm the running kernel matches the fixed build
uname -r