Linux kernel HID Steam driver: Improper resource cleanup on teardown
Summary
The Linux kernel HID driver for Valve Steam Controller hardware (hid-steam) can leave a lingering power_supply object after the Steam object is torn down, because a battery unregistration step was missing after an earlier refactor. The CVSS vector is local, requires low privileges and rates impact as high, but the description reads as a resource lifecycle bug without a concrete code execution path. An attacker would need a local account or a way to trigger the driver, and no exploitation or public proof of concept has been found.
Affected
- Linux kernel with the hid-steam driver; the CNA record lists affected commits from 385a4886778f6d6e61eff1d4d295af332d7130e1 onward and a range 4.19.6 to < 4.20
- The sources do not give a clear, consistent affected version range; verify against your kernel branch
- Systems without Steam Controller hardware are less relevant
Fixed in
- Stable kernel branches per OSV: 5.10.273, 5.15.224, 6.1.191, 6.6.160, 6.12.113, 6.18.57, 7.2.11
- Fixed in mainline by the commits referenced in the CVE record
- Confirm the fixed release for your distribution's kernel package
Workaround
- No vendor workaround found.
- If no Steam Controller hardware is used, blacklisting the hid_steam module may reduce exposure; this has not been verified against a source, so test it first.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof of concept found.
- EPSS score reported as 0.00175 (very low).
Our recommendation
- Include the kernel update in the next regular maintenance cycle.
- Prioritise multi-user systems, gaming PCs and workstations where Steam Controller hardware is attached.
- Check whether your distribution has released a kernel containing the fix and install it.
- Restart after the update so the new kernel is active.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux stable commit 2b15e10a git.kernel.org
- Linux stable commit 6e44418d git.kernel.org
- Linux stable commit 6f9b740c git.kernel.org
- Linux stable commit bdfad775 git.kernel.org
- Ubuntu security tracker CVE-2026-98944 ubuntu.com
- OSV record via Vulners vulners.com
- NVD record via Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:37.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: HID: steam: Refactor registration This refactors and simplifies the registration/unregistration flow. Since we now only perform registration when the client isn't opened anymore, the logic for handling that can be removed, and the rest of the function streamlined. We also remove the previous assumption that we have a serial number to show we're registered, replacing it with a single purpose boolean. In a previous refactor the code for unregistering a battery if later registration steps failed was accidentally left out. As a result, a lingering power_supply object could get left over after the steam object was torn down. This is also fixed here.
NVD references (8)
- https://git.kernel.org/stable/c/2b15e10aff95c78dbacc4fa32fa90c9098213e03
- https://git.kernel.org/stable/c/39568571aee4f5499a6d254812fe4b75dc3d4ace
- https://git.kernel.org/stable/c/3c2f97343d4df2a75747f4c79effa0587509888f
- https://git.kernel.org/stable/c/6e44418d3a06f023877959cc6dd7386ec7f64d59
- https://git.kernel.org/stable/c/6f9b740c31ba7e061b2ebb330d9a3d63f1358f29
- https://git.kernel.org/stable/c/bdfad7759fef1a5d8be9bacee3c72ce40f148b63
- https://git.kernel.org/stable/c/c06cf54fe99b8c6bcf2017bb076c0e3918608cea
- https://git.kernel.org/stable/c/cf71a6ee1d4e36b8e65b81c064e2797a10247280
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.