Linux Kernel CVE-2026-43111

The vulnerability exists in the Linux kernel's Human Interface Device (HID) subsystem, specifically the roccat driver used for Roccat gaming peripherals. The roccat_report_event() function traverses the device->readers linked list without acquiring the readers_lock mutex, creating a time-of-check-time-of-use race condition. When roccat_release() executes concurrently on another thread, it can remove and deallocate a reader structure while roccat_report_event() still holds a pointer to it, resulting in a classic use-after-free condition. This represents a CWE-416 class vulnerability (Use After Free) where freed heap memory is accessed, potentially allowing arbitrary memory reads/writes depending on heap allocation patterns. The roccat driver facilitates communication with Roccat brand HID devices through a character device interface with multiple concurrent reader processes.