roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free in certain situations where a report is received while copying a report->value is in progress.
| Product | Vendor | Version |
|---|---|---|
| n/a | n/a | < 10.0.14393.7070 |
| n/a | n/a | <= 6.3.* |