◆ CVE Hub

CVE-2026-98945

HID: steam: Rearrange teardown sequence

Published
2026-10-23
Last modified
2026-10-24
CNA
Linux
NVD status
Received
CVSS v3.1 (listed by NVD)
7.8
HIGH
Scored by Linux (not yet scored by NVD)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0 (listed by NVD)
—
Not scored
CVSS (listed by CVE.org)
7.8
HIGH
Scored by CNA (Linux) · v3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS exploit probability
0.2%
Percentile 10.5%
as of 2026-10-24
CISA KEV
—
Not listed

Attack conditions and impact

Derived from the CNA (via NVD) CVSS 3.1 vector
LocalLoginNo interaction Confidentiality HIntegrity HAvailability H
MetricValueMeaning
Attack vector AVLLocal
Attack complexity ACLLow (easy)
Privileges required PRLRegular user
User interaction UINNone
Scope SUUnchanged
Confidentiality CHHigh
Integrity IHHigh
Availability AHHigh
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

NVD

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Rearrange teardown sequence This fixes a narrow window during the teardown sequence where callbacks could still be scheduled during cleanup that would then have a dangling pointer to the now-freed steam struct. This also puts work canceling for rumble and mode switch in steam_unregister, as that shouldn't persist while the client hdev is open.

CVSS assessments

ProviderVersionScoreVector
NVD / 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary)3.17.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA / Linux3.17.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products and packages

CNA (CVE.org)

VendorProductVersions
LinuxLinux
affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 … < d2587923d50c8b141ce0ccb284c714cf6054d6a7
affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 … < 81a8209c09f9be7eef860ca6cc154749a6b4d243
affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 … < 86724f4bcf6049c3a322f7a7b1f968210059c46a
affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 … < b5ea938ff776306798d3a11485c2475034f92131
affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 … < ddce9641ce924ed91ec8304577e463823a29ffaf
affected: 0 … < 6.6.160
affected: 0 … < 6.12.113
affected: 0 … < 6.18.57
affected: 0 … < 7.2.11
default: unaffected
LinuxLinux
unaffected: 6.6.160 … <= 6.6.*
unaffected: 6.12.113 … <= 6.12.*
unaffected: 6.18.57 … <= 6.18.*
unaffected: 7.2.11 … <= 7.2.*
unaffected: 7.3 … <= *
default: affected

Open-source packages (GitHub Advisory / OSV)

CVE-2026-98945 OSV

HID: steam: Rearrange teardown sequence

EcosystemPackageAffected versionsFixed in
>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < d2587923d50c8b141ce0ccb284c714cf6054d6a7; < 81a8209c09f9be7eef860ca6cc154749a6b4d243; < 86724f4bcf6049c3a322f7a7b1f968210059c46a; < b5ea938ff776306798d3a11485c2475034f92131; < ddce9641ce924ed91ec8304577e463823a29ffaf; < 6.6.160; < 6.12.113; < 6.18.57; < 7.2.11
v6.6.159, v6.6.158, v7.2.10, v6.18.56, v6.12.112, v7.2.9, v6.18.55, v7.2.8, v6.18.54, v6.12.111, v6.6.157, v7.2, v7.2.7, v6.18.53, v7.2.6, v6.18.52, v6.12.110, v7.2.5, v6.18.51, v6.12.109, … (+1241)
d2587923d50c8b141ce0ccb284c714cf6054d6a7, 81a8209c09f9be7eef860ca6cc154749a6b4d243, 86724f4bcf6049c3a322f7a7b1f968210059c46a, b5ea938ff776306798d3a11485c2475034f92131, ddce9641ce924ed91ec8304577e463823a29ffaf, 6.6.160, 6.12.113, 6.18.57, 7.2.11
LinuxKernel< 6.6.160; >= 6.7.0, < 6.12.113; >= 6.13.0, < 6.18.57; >= 6.19.0, < 7.2.116.6.160, 6.12.113, 6.18.57, 7.2.11

Linux distribution status

Red Hat ↗

No record

Debian ↗

ReleasePackageStatusFixed version / notes
bookwormlinuxopen not yet assigned
forkylinuxresolved not yet assigned7.2.11-1
sidlinuxresolved not yet assigned7.2.11-1
trixielinuxresolved not yet assigned6.12.113-1

Ubuntu ↗

No record

References (8)