Linux kernel hid-steam: Teardown sequence flaw with dangling pointer risk
Summary
The hid-steam HID driver of the Linux kernel, used for Steam Controller and Steam Deck input, can schedule callbacks during device teardown. These callbacks may then reference the already freed steam structure, which is a dangling pointer. A local attacker with low privileges could potentially crash the system or execute code, with high impact on confidentiality, integrity and availability (CVSS 3.1: 7.8).
Affected
- Linux kernel from 6.3 onward (introduced by commit 9cd61c8179781344315c2a9816977ea415c5459e)
- Kernel versions before 6.3 are listed as unaffected in the CNA record
- Note: the CNA record marks 7.3 and later as affected by default
Fixed in
- 6.6.160 and later in the 6.6 series
- 6.12.113 and later in the 6.12 series
- 6.18.57 and later in the 6.18 series
- 7.2.11 and later in the 7.2 series
- Fix commits: 81a8209c, 86724f4b, b5ea938f, d2587923, ddce9641
- Distribution kernels may differ; check the vendor advisory for exact package versions
Workaround
- No vendor workaround documented.
- Untested option: blacklist the hid-steam module on systems without Valve controllers. This also removes Steam Controller and Steam Deck input support.
Exploitation
- No known exploitation in the wild at the time of writing.
- No public proof of concept found.
- EPSS score: 0.00163.
Our recommendation
- Install the fixed kernel version through the normal update cycle on Linux hosts.
- Prioritise workstations, kiosks and devices with Steam Controller or Steam Deck hardware attached.
- Verify exposure with the command lsmod | grep hid_steam on relevant systems.
- Servers without this hardware have low relevance; monitor the vendor advisory for distribution-specific fix versions.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux kernel stable commit 81a8209c git.kernel.org
- Linux kernel stable commit d2587923 git.kernel.org
- OSV entry for CVE-2026-98945 vulners.com
- NVD record mirror on Vulners vulners.com
- Ubuntu security notice CVE-2026-98945 ubuntu.com
- SUSE CVE entry on Vulners vulners.com
- Linux kernel stable commit ddce9641 git.kernel.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:38.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: HID: steam: Rearrange teardown sequence This fixes a narrow window during the teardown sequence where callbacks could still be scheduled during cleanup that would then have a dangling pointer to the now-freed steam struct. This also puts work canceling for rumble and mode switch in steam_unregister, as that shouldn't persist while the client hdev is open.
NVD references (5)
- https://git.kernel.org/stable/c/81a8209c09f9be7eef860ca6cc154749a6b4d243
- https://git.kernel.org/stable/c/86724f4bcf6049c3a322f7a7b1f968210059c46a
- https://git.kernel.org/stable/c/b5ea938ff776306798d3a11485c2475034f92131
- https://git.kernel.org/stable/c/d2587923d50c8b141ce0ccb284c714cf6054d6a7
- https://git.kernel.org/stable/c/ddce9641ce924ed91ec8304577e463823a29ffaf
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.