{"id":"AZL-100359","summary":"CVE-2026-89627 affecting package kernel 6.6.150.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: roccat: free buffered reports when destroying device\n\nroccat_report_event() duplicates each report with kmemdup() and stores\nthe allocation in a circular-buffer slot. The allocation is released only\nwhen that slot is reused.\n\nThe device destruction paths free struct roccat_device without releasing\nreports still stored in cbuf[]. This makes those allocations unreachable\nand leaks up to ROCCAT_CBUF_SIZE report buffers per device.\n\nAdd a small destructor that frees every buffered report before freeing the\ndevice, and use it in both paths that can destroy a registered device.","modified":"2026-09-13T06:06:36Z","published":"2026-09-11T20:19:48Z","upstream":["CVE-2026-89627"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89627"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.150.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-100359.json"}}],"schema_version":"1.9.0"}