CVE-2026-98944 (GCVE-0-2026-98944)
Vulnerability from cvelistv5
Published
2026-10-23 12:19
Modified
2026-10-30 12:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: steam: Refactor registration
This refactors and simplifies the registration/unregistration flow. Since
we now only perform registration when the client isn't opened anymore, the
logic for handling that can be removed, and the rest of the function
streamlined.
We also remove the previous assumption that we have a serial number to show
we're registered, replacing it with a single purpose boolean.
In a previous refactor the code for unregistering a battery if later
registration steps failed was accidentally left out. As a result, a
lingering power_supply object could get left over after the steam object
was torn down. This is also fixed here.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 385a4886778f6d6e61eff1d4d295af332d7130e1 Version: 385a4886778f6d6e61eff1d4d295af332d7130e1 Version: 385a4886778f6d6e61eff1d4d295af332d7130e1 Version: 385a4886778f6d6e61eff1d4d295af332d7130e1 Version: 385a4886778f6d6e61eff1d4d295af332d7130e1 Version: 385a4886778f6d6e61eff1d4d295af332d7130e1 Version: 385a4886778f6d6e61eff1d4d295af332d7130e1 Version: 385a4886778f6d6e61eff1d4d295af332d7130e1 Version: fb87a92b43961c89bf4a115d8a700885d8959cb1 Version: 4.19.6 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-steam.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6e44418d3a06f023877959cc6dd7386ec7f64d59",
"status": "affected",
"version": "385a4886778f6d6e61eff1d4d295af332d7130e1",
"versionType": "git"
},
{
"lessThan": "bdfad7759fef1a5d8be9bacee3c72ce40f148b63",
"status": "affected",
"version": "385a4886778f6d6e61eff1d4d295af332d7130e1",
"versionType": "git"
},
{
"lessThan": "39568571aee4f5499a6d254812fe4b75dc3d4ace",
"status": "affected",
"version": "385a4886778f6d6e61eff1d4d295af332d7130e1",
"versionType": "git"
},
{
"lessThan": "3c2f97343d4df2a75747f4c79effa0587509888f",
"status": "affected",
"version": "385a4886778f6d6e61eff1d4d295af332d7130e1",
"versionType": "git"
},
{
"lessThan": "2b15e10aff95c78dbacc4fa32fa90c9098213e03",
"status": "affected",
"version": "385a4886778f6d6e61eff1d4d295af332d7130e1",
"versionType": "git"
},
{
"lessThan": "cf71a6ee1d4e36b8e65b81c064e2797a10247280",
"status": "affected",
"version": "385a4886778f6d6e61eff1d4d295af332d7130e1",
"versionType": "git"
},
{
"lessThan": "c06cf54fe99b8c6bcf2017bb076c0e3918608cea",
"status": "affected",
"version": "385a4886778f6d6e61eff1d4d295af332d7130e1",
"versionType": "git"
},
{
"lessThan": "6f9b740c31ba7e061b2ebb330d9a3d63f1358f29",
"status": "affected",
"version": "385a4886778f6d6e61eff1d4d295af332d7130e1",
"versionType": "git"
},
{
"status": "affected",
"version": "fb87a92b43961c89bf4a115d8a700885d8959cb1",
"versionType": "git"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-steam.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: steam: Refactor registration\n\nThis refactors and simplifies the registration/unregistration flow. Since\nwe now only perform registration when the client isn\u0027t opened anymore, the\nlogic for handling that can be removed, and the rest of the function\nstreamlined.\n\nWe also remove the previous assumption that we have a serial number to show\nwe\u0027re registered, replacing it with a single purpose boolean.\n\nIn a previous refactor the code for unregistering a battery if later\nregistration steps failed was accidentally left out. As a result, a\nlingering power_supply object could get left over after the steam object\nwas torn down. This is also fixed here."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - write() to /dev/uhid enters uhid_char_write() and uhid_dev_create2(), which accept attacker-chosen BUS_USB, Valve IDs, and descriptor; hid_add_device() binds steam_probe(), and an injected wireless-connect report reaches steam_raw_event(), steam_work_connect_cb(), and patched steam_register().\nAC:L - The attacker answers UHID_GET_REPORT for ID_GET_STRING_ATTRIBUTE with payload length 1 and the expected tag, so steam_get_serial() succeeds but leaves serial_no empty, then issues UHID_DESTROY; setup and teardown are attacker-controlled without a race or external condition.\nPR:L - Neither uhid_char_write() nor uhid_dev_create2() performs a capability check; access is governed only by /dev/uhid DAC, so a logged-in user granted this userspace-HID node can execute the complete create, reply, and destroy sequence without administrator privileges.\nUI:N - The attacker\u0027s process creates the emulated wireless controller, supplies the crafted feature reply and connection event, destroys it, and accesses the lingering power-supply object; no victim action is required.\nS:U - The freed steam_device, its embedded power_supply_desc, and the resulting callback execution all reside under the host kernel\u0027s security authority; no VM, IOMMU, or separate sandbox boundary is crossed.\nC:H - steam_battery_register() passes \u0026steam-\u003ebattery_desc and steam as power-supply state, but vulnerable steam_unregister() returns on empty serial_no; UHID destruction frees steam while readable power-supply properties retain both dangling pointers, enabling attacker-groomed kernel-memory reads.\nI:H - __power_supply_get_property() later dereferences the freed descriptor and indirectly calls psy-\u003edesc-\u003eget_property; reclaiming the devm allocation with controlled UHID descriptor data can replace that function pointer, enabling control-flow hijacking and arbitrary writes.\nA:H - Reading the lingering steam-controller--battery capacity attribute reaches power_supply_show_property() and dereferences the freed descriptor or callback, causing an oops or panic; the attacker can repeat the UHID create-and-destroy sequence."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:40:28.138Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6e44418d3a06f023877959cc6dd7386ec7f64d59"
},
{
"url": "https://git.kernel.org/stable/c/bdfad7759fef1a5d8be9bacee3c72ce40f148b63"
},
{
"url": "https://git.kernel.org/stable/c/39568571aee4f5499a6d254812fe4b75dc3d4ace"
},
{
"url": "https://git.kernel.org/stable/c/3c2f97343d4df2a75747f4c79effa0587509888f"
},
{
"url": "https://git.kernel.org/stable/c/2b15e10aff95c78dbacc4fa32fa90c9098213e03"
},
{
"url": "https://git.kernel.org/stable/c/cf71a6ee1d4e36b8e65b81c064e2797a10247280"
},
{
"url": "https://git.kernel.org/stable/c/c06cf54fe99b8c6bcf2017bb076c0e3918608cea"
},
{
"url": "https://git.kernel.org/stable/c/6f9b740c31ba7e061b2ebb330d9a3d63f1358f29"
}
],
"title": "HID: steam: Refactor registration",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98944",
"datePublished": "2026-10-23T12:19:02.560Z",
"dateReserved": "2026-09-25T10:25:14.381Z",
"dateUpdated": "2026-10-30T12:40:28.138Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…