CVE-2026-93188

Description

In the Linux kernel, the following vulnerability has been resolved: HID: roccat: bound device-supplied profile index kone_keep_values_up_to_date() and kone_profile_activated() use an 8-bit, device-supplied profile value as an index into the 5-element kone->profiles[] array without a range check. A malicious USB device claiming the Roccat Kone id can send a switch-profile event (or a startup_profile read at probe) with an out-of-range value and make the driver read out of bounds; the result is exposed via the actual_dpi sysfs attribute. Reject out-of-range indices in both paths. This was found with static analysis and confirmed with the KUnit test added in the following patch (KASAN: slab-out-of-bounds).

Is your site exposed to CVE-2026-93188?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0020

Probability of exploitation

0.09%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/0a139188a7ce4baab7acc5d60e0d1c8657f9b4d4 https://git.kernel.org/stable/c/43fae42628a8c10fa8981773d7ec9f1a367821a7 https://git.kernel.org/stable/c/4b29be4b23bc28f59def1485702887e395256e11 https://git.kernel.org/stable/c/579c78c8c317ecff8b6b820c227c93e6ec4e565d https://git.kernel.org/stable/c/635914c60da26a9892f27ffb5edcc922a10effab https://git.kernel.org/stable/c/67d7851f113fd0205dd27416d3c47ab32b176097 https://git.kernel.org/stable/c/686e5c3bd378933b4e795fcc7d40c5aad358eaaa https://git.kernel.org/stable/c/99330b12376c3373ab555c24bc797630f03b81a2

Frequently Asked Questions

What is CVE-2026-93188? +

In the Linux kernel, the following vulnerability has been resolved: HID: roccat: bound device-supplied profile index kone_keep_values_up_to_date() and kone_profile_activated() use an 8-bit, device-supplied profile value as an index into the 5-element kone->profiles[] array without a range check. A malicious USB device claiming the Roccat Kone id can send a switch-profile event (or a startup_profile read at probe) with an out-of-range value and make the driver read out of bounds; the result is exposed via the actual_dpi sysfs attribute. Reject out-of-range indices in both paths. This was found with static analysis and confirmed with the KUnit test added in the following patch (KASAN: slab-out-of-bounds).

How do I check if I'm vulnerable to CVE-2026-93188? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.