◆ CVE Hub

CVE-2026-98944

HID: steam: Refactor registration

Published
2026-10-23
Last modified
2026-10-24
CNA
Linux
NVD status
Received
CVSS v3.1 (listed by NVD)
7.8
HIGH
Scored by Linux (not yet scored by NVD)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0 (listed by NVD)
—
Not scored
CVSS (listed by CVE.org)
7.8
HIGH
Scored by CNA (Linux) · v3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS exploit probability
0.2%
Percentile 10.5%
as of 2026-10-24
CISA KEV
—
Not listed

Attack conditions and impact

Derived from the CNA (via NVD) CVSS 3.1 vector
LocalLoginNo interaction Confidentiality HIntegrity HAvailability H
MetricValueMeaning
Attack vector AVLLocal
Attack complexity ACLLow (easy)
Privileges required PRLRegular user
User interaction UINNone
Scope SUUnchanged
Confidentiality CHHigh
Integrity IHHigh
Availability AHHigh
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

NVD

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Refactor registration This refactors and simplifies the registration/unregistration flow. Since we now only perform registration when the client isn't opened anymore, the logic for handling that can be removed, and the rest of the function streamlined. We also remove the previous assumption that we have a serial number to show we're registered, replacing it with a single purpose boolean. In a previous refactor the code for unregistering a battery if later registration steps failed was accidentally left out. As a result, a lingering power_supply object could get left over after the steam object was torn down. This is also fixed here.

CVSS assessments

ProviderVersionScoreVector
NVD / 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary)3.17.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA / Linux3.17.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products and packages

CNA (CVE.org)

VendorProductVersions
LinuxLinux
affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 … < 3c2f97343d4df2a75747f4c79effa0587509888f
affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 … < 2b15e10aff95c78dbacc4fa32fa90c9098213e03
affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 … < cf71a6ee1d4e36b8e65b81c064e2797a10247280
affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 … < c06cf54fe99b8c6bcf2017bb076c0e3918608cea
affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 … < 6f9b740c31ba7e061b2ebb330d9a3d63f1358f29
affected: 0 … < 6.6.160
affected: 0 … < 6.12.113
affected: 0 … < 6.18.57
affected: 0 … < 7.2.11
default: unaffected
LinuxLinux
unaffected: 6.6.160 … <= 6.6.*
unaffected: 6.12.113 … <= 6.12.*
unaffected: 6.18.57 … <= 6.18.*
unaffected: 7.2.11 … <= 7.2.*
unaffected: 7.3 … <= *
default: affected

Open-source packages (GitHub Advisory / OSV)

CVE-2026-98944 OSV

HID: steam: Refactor registration

EcosystemPackageAffected versionsFixed in
>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 3c2f97343d4df2a75747f4c79effa0587509888f; < 2b15e10aff95c78dbacc4fa32fa90c9098213e03; < cf71a6ee1d4e36b8e65b81c064e2797a10247280; < c06cf54fe99b8c6bcf2017bb076c0e3918608cea; < 6f9b740c31ba7e061b2ebb330d9a3d63f1358f29; < 6.6.160; < 6.12.113; < 6.18.57; < 7.2.11
v6.6.159, v6.6.158, v7.2.10, v6.18.56, v6.12.112, v7.2.9, v6.18.55, v7.2.8, v6.18.54, v6.12.111, v6.6.157, v7.2, v7.2.7, v6.18.53, v7.2.6, v6.18.52, v6.12.110, v7.2.5, v6.18.51, v6.12.109, … (+1241)
3c2f97343d4df2a75747f4c79effa0587509888f, 2b15e10aff95c78dbacc4fa32fa90c9098213e03, cf71a6ee1d4e36b8e65b81c064e2797a10247280, c06cf54fe99b8c6bcf2017bb076c0e3918608cea, 6f9b740c31ba7e061b2ebb330d9a3d63f1358f29, 6.6.160, 6.12.113, 6.18.57, 7.2.11
LinuxKernel< 6.6.160; >= 6.7.0, < 6.12.113; >= 6.13.0, < 6.18.57; >= 6.19.0, < 7.2.116.6.160, 6.12.113, 6.18.57, 7.2.11

Linux distribution status

Red Hat ↗

No record

Debian ↗

ReleasePackageStatusFixed version / notes
bookwormlinuxopen not yet assigned
forkylinuxresolved not yet assigned7.2.11-1
sidlinuxresolved not yet assigned7.2.11-1
trixielinuxresolved not yet assigned6.12.113-1

Ubuntu ↗

No record

References (8)