CVE-2026-98944 (GCVE-0-2026-98944)

Vulnerability from cvelistv5 – Published: 2026-10-23 12:19 – Updated: 2026-10-26 06:56
VLAI
Title
HID: steam: Refactor registration
Summary
In the Linux kernel, the following vulnerability has been resolved: HID: steam: Refactor registration This refactors and simplifies the registration/unregistration flow. Since we now only perform registration when the client isn't opened anymore, the logic for handling that can be removed, and the rest of the function streamlined. We also remove the previous assumption that we have a serial number to show we're registered, replacing it with a single purpose boolean. In a previous refactor the code for unregistering a battery if later registration steps failed was accidentally left out. As a result, a lingering power_supply object could get left over after the steam object was torn down. This is also fixed here.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 7067 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 385a4886778f6d6e61eff1d4d295af332d7130e1 , < 3c2f97343d4df2a75747f4c79effa0587509888f (git)
Affected: 385a4886778f6d6e61eff1d4d295af332d7130e1 , < 2b15e10aff95c78dbacc4fa32fa90c9098213e03 (git)
Affected: 385a4886778f6d6e61eff1d4d295af332d7130e1 , < cf71a6ee1d4e36b8e65b81c064e2797a10247280 (git)
Affected: 385a4886778f6d6e61eff1d4d295af332d7130e1 , < c06cf54fe99b8c6bcf2017bb076c0e3918608cea (git)
Affected: 385a4886778f6d6e61eff1d4d295af332d7130e1 , < 6f9b740c31ba7e061b2ebb330d9a3d63f1358f29 (git)
Affected: fb87a92b43961c89bf4a115d8a700885d8959cb1 (git)
Affected: 4.19.6 , < 4.20 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 4.20
Unaffected: 0 , < 4.20 (semver)
Unaffected: 6.6.160 , ≤ 6.6.* (semver)
Unaffected: 6.12.113 , ≤ 6.12.* (semver)
Unaffected: 6.18.57 , ≤ 6.18.* (semver)
Unaffected: 7.2.11 , ≤ 7.2.* (semver)
Unaffected: 7.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-steam.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3c2f97343d4df2a75747f4c79effa0587509888f",
              "status": "affected",
              "version": "385a4886778f6d6e61eff1d4d295af332d7130e1",
              "versionType": "git"
            },
            {
              "lessThan": "2b15e10aff95c78dbacc4fa32fa90c9098213e03",
              "status": "affected",
              "version": "385a4886778f6d6e61eff1d4d295af332d7130e1",
              "versionType": "git"
            },
            {
              "lessThan": "cf71a6ee1d4e36b8e65b81c064e2797a10247280",
              "status": "affected",
              "version": "385a4886778f6d6e61eff1d4d295af332d7130e1",
              "versionType": "git"
            },
            {
              "lessThan": "c06cf54fe99b8c6bcf2017bb076c0e3918608cea",
              "status": "affected",
              "version": "385a4886778f6d6e61eff1d4d295af332d7130e1",
              "versionType": "git"
            },
            {
              "lessThan": "6f9b740c31ba7e061b2ebb330d9a3d63f1358f29",
              "status": "affected",
              "version": "385a4886778f6d6e61eff1d4d295af332d7130e1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "fb87a92b43961c89bf4a115d8a700885d8959cb1",
              "versionType": "git"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-steam.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.113",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.11",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: steam: Refactor registration\n\nThis refactors and simplifies the registration/unregistration flow. Since\nwe now only perform registration when the client isn\u0027t opened anymore, the\nlogic for handling that can be removed, and the rest of the function\nstreamlined.\n\nWe also remove the previous assumption that we have a serial number to show\nwe\u0027re registered, replacing it with a single purpose boolean.\n\nIn a previous refactor the code for unregistering a battery if later\nregistration steps failed was accidentally left out. As a result, a\nlingering power_supply object could get left over after the steam object\nwas torn down. This is also fixed here."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - write() to /dev/uhid enters uhid_char_write() and uhid_dev_create2(), which accept attacker-chosen BUS_USB, Valve IDs, and descriptor; hid_add_device() binds steam_probe(), and an injected wireless-connect report reaches steam_raw_event(), steam_work_connect_cb(), and patched steam_register().\nAC:L - The attacker answers UHID_GET_REPORT for ID_GET_STRING_ATTRIBUTE with payload length 1 and the expected tag, so steam_get_serial() succeeds but leaves serial_no empty, then issues UHID_DESTROY; setup and teardown are attacker-controlled without a race or external condition.\nPR:L - Neither uhid_char_write() nor uhid_dev_create2() performs a capability check; access is governed only by /dev/uhid DAC, so a logged-in user granted this userspace-HID node can execute the complete create, reply, and destroy sequence without administrator privileges.\nUI:N - The attacker\u0027s process creates the emulated wireless controller, supplies the crafted feature reply and connection event, destroys it, and accesses the lingering power-supply object; no victim action is required.\nS:U - The freed steam_device, its embedded power_supply_desc, and the resulting callback execution all reside under the host kernel\u0027s security authority; no VM, IOMMU, or separate sandbox boundary is crossed.\nC:H - steam_battery_register() passes \u0026steam-\u003ebattery_desc and steam as power-supply state, but vulnerable steam_unregister() returns on empty serial_no; UHID destruction frees steam while readable power-supply properties retain both dangling pointers, enabling attacker-groomed kernel-memory reads.\nI:H - __power_supply_get_property() later dereferences the freed descriptor and indirectly calls psy-\u003edesc-\u003eget_property; reclaiming the devm allocation with controlled UHID descriptor data can replace that function pointer, enabling control-flow hijacking and arbitrary writes.\nA:H - Reading the lingering steam-controller--battery capacity attribute reaches power_supply_show_property() and dereferences the freed descriptor or callback, causing an oops or panic; the attacker can repeat the UHID create-and-destroy sequence."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T06:56:53.861Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3c2f97343d4df2a75747f4c79effa0587509888f"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b15e10aff95c78dbacc4fa32fa90c9098213e03"
        },
        {
          "url": "https://git.kernel.org/stable/c/cf71a6ee1d4e36b8e65b81c064e2797a10247280"
        },
        {
          "url": "https://git.kernel.org/stable/c/c06cf54fe99b8c6bcf2017bb076c0e3918608cea"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f9b740c31ba7e061b2ebb330d9a3d63f1358f29"
        }
      ],
      "title": "HID: steam: Refactor registration",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98944",
    "datePublished": "2026-10-23T12:19:02.560Z",
    "dateReserved": "2026-09-25T10:25:14.381Z",
    "dateUpdated": "2026-10-26T06:56:53.861Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-98944",
      "date": "2026-10-26",
      "epss": "0.00175",
      "percentile": "0.06941"
    },
    "microsoft_vex": {
      "current_release_date": "2026-10-25T01:01:57.000Z",
      "cve": "CVE-2026-98944",
      "id": "msrc_CVE-2026-98944",
      "initial_release_date": "2026-10-24T01:09:05.000Z",
      "product_status:under_investigation": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "HID: steam: Refactor registration",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-98944.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/hid/hid-steam.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3c2f97343d4df2a75747f4c79effa0587509888f",
                    "status": "affected",
                    "version": "385a4886778f6d6e61eff1d4d295af332d7130e1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2b15e10aff95c78dbacc4fa32fa90c9098213e03",
                    "status": "affected",
                    "version": "385a4886778f6d6e61eff1d4d295af332d7130e1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cf71a6ee1d4e36b8e65b81c064e2797a10247280",
                    "status": "affected",
                    "version": "385a4886778f6d6e61eff1d4d295af332d7130e1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c06cf54fe99b8c6bcf2017bb076c0e3918608cea",
                    "status": "affected",
                    "version": "385a4886778f6d6e61eff1d4d295af332d7130e1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6f9b740c31ba7e061b2ebb330d9a3d63f1358f29",
                    "status": "affected",
                    "version": "385a4886778f6d6e61eff1d4d295af332d7130e1",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "fb87a92b43961c89bf4a115d8a700885d8959cb1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4.20",
                    "status": "affected",
                    "version": "4.19.6",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/hid/hid-steam.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.20"
                  },
                  {
                    "lessThan": "4.20",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.160",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.113",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.57",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: steam: Refactor registration\n\nThis refactors and simplifies the registration/unregistration flow. Since\nwe now only perform registration when the client isn\u0027t opened anymore, the\nlogic for handling that can be removed, and the rest of the function\nstreamlined.\n\nWe also remove the previous assumption that we have a serial number to show\nwe\u0027re registered, replacing it with a single purpose boolean.\n\nIn a previous refactor the code for unregistering a battery if later\nregistration steps failed was accidentally left out. As a result, a\nlingering power_supply object could get left over after the steam object\nwas torn down. This is also fixed here."
          }
        ],
        "id": "CVE-2026-98944",
        "lastModified": "2026-10-26T07:17:18.120",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-23T13:17:15.417",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2b15e10aff95c78dbacc4fa32fa90c9098213e03"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3c2f97343d4df2a75747f4c79effa0587509888f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6f9b740c31ba7e061b2ebb330d9a3d63f1358f29"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c06cf54fe99b8c6bcf2017bb076c0e3918608cea"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cf71a6ee1d4e36b8e65b81c064e2797a10247280"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.