{"api_version":"1","generated_at":"2026-10-26T08:56:12+00:00","cve":"CVE-2026-98944","urls":{"html":"https://cve.report/CVE-2026-98944","api":"https://cve.report/api/cve/CVE-2026-98944.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-98944","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-98944"},"summary":{"title":"HID: steam: Refactor registration","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: steam: Refactor registration\n\nThis refactors and simplifies the registration/unregistration flow. Since\nwe now only perform registration when the client isn't opened anymore, the\nlogic for handling that can be removed, and the rest of the function\nstreamlined.\n\nWe also remove the previous assumption that we have a serial number to show\nwe're registered, replacing it with a single purpose boolean.\n\nIn a previous refactor the code for unregistering a battery if later\nregistration steps failed was accidentally left out. As a result, a\nlingering power_supply object could get left over after the steam object\nwas torn down. This is also fixed here.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-10-23 13:17:15","updated_at":"2026-10-26 07:17:18"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/3c2f97343d4df2a75747f4c79effa0587509888f","name":"https://git.kernel.org/stable/c/3c2f97343d4df2a75747f4c79effa0587509888f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/c06cf54fe99b8c6bcf2017bb076c0e3918608cea","name":"https://git.kernel.org/stable/c/c06cf54fe99b8c6bcf2017bb076c0e3918608cea","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/cf71a6ee1d4e36b8e65b81c064e2797a10247280","name":"https://git.kernel.org/stable/c/cf71a6ee1d4e36b8e65b81c064e2797a10247280","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/6f9b740c31ba7e061b2ebb330d9a3d63f1358f29","name":"https://git.kernel.org/stable/c/6f9b740c31ba7e061b2ebb330d9a3d63f1358f29","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/2b15e10aff95c78dbacc4fa32fa90c9098213e03","name":"https://git.kernel.org/stable/c/2b15e10aff95c78dbacc4fa32fa90c9098213e03","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98944","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98944","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 385a4886778f6d6e61eff1d4d295af332d7130e1 3c2f97343d4df2a75747f4c79effa0587509888f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 385a4886778f6d6e61eff1d4d295af332d7130e1 2b15e10aff95c78dbacc4fa32fa90c9098213e03 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 385a4886778f6d6e61eff1d4d295af332d7130e1 cf71a6ee1d4e36b8e65b81c064e2797a10247280 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 385a4886778f6d6e61eff1d4d295af332d7130e1 c06cf54fe99b8c6bcf2017bb076c0e3918608cea git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 385a4886778f6d6e61eff1d4d295af332d7130e1 6f9b740c31ba7e061b2ebb330d9a3d63f1358f29 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fb87a92b43961c89bf4a115d8a700885d8959cb1 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.19.6 4.20 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.20","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.20 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.160 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.113 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.57 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.11 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hid/hid-steam.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3c2f97343d4df2a75747f4c79effa0587509888f","status":"affected","version":"385a4886778f6d6e61eff1d4d295af332d7130e1","versionType":"git"},{"lessThan":"2b15e10aff95c78dbacc4fa32fa90c9098213e03","status":"affected","version":"385a4886778f6d6e61eff1d4d295af332d7130e1","versionType":"git"},{"lessThan":"cf71a6ee1d4e36b8e65b81c064e2797a10247280","status":"affected","version":"385a4886778f6d6e61eff1d4d295af332d7130e1","versionType":"git"},{"lessThan":"c06cf54fe99b8c6bcf2017bb076c0e3918608cea","status":"affected","version":"385a4886778f6d6e61eff1d4d295af332d7130e1","versionType":"git"},{"lessThan":"6f9b740c31ba7e061b2ebb330d9a3d63f1358f29","status":"affected","version":"385a4886778f6d6e61eff1d4d295af332d7130e1","versionType":"git"},{"status":"affected","version":"fb87a92b43961c89bf4a115d8a700885d8959cb1","versionType":"git"},{"lessThan":"4.20","status":"affected","version":"4.19.6","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hid/hid-steam.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.20"},{"lessThan":"4.20","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.113","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.57","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.160","versionStartIncluding":"4.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.113","versionStartIncluding":"4.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.57","versionStartIncluding":"4.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.11","versionStartIncluding":"4.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3","versionStartIncluding":"4.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19.6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: steam: Refactor registration\n\nThis refactors and simplifies the registration/unregistration flow. Since\nwe now only perform registration when the client isn't opened anymore, the\nlogic for handling that can be removed, and the rest of the function\nstreamlined.\n\nWe also remove the previous assumption that we have a serial number to show\nwe're registered, replacing it with a single purpose boolean.\n\nIn a previous refactor the code for unregistering a battery if later\nregistration steps failed was accidentally left out. As a result, a\nlingering power_supply object could get left over after the steam object\nwas torn down. This is also fixed here."}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - write() to /dev/uhid enters uhid_char_write() and uhid_dev_create2(), which accept attacker-chosen BUS_USB, Valve IDs, and descriptor; hid_add_device() binds steam_probe(), and an injected wireless-connect report reaches steam_raw_event(), steam_work_connect_cb(), and patched steam_register().\nAC:L - The attacker answers UHID_GET_REPORT for ID_GET_STRING_ATTRIBUTE with payload length 1 and the expected tag, so steam_get_serial() succeeds but leaves serial_no empty, then issues UHID_DESTROY; setup and teardown are attacker-controlled without a race or external condition.\nPR:L - Neither uhid_char_write() nor uhid_dev_create2() performs a capability check; access is governed only by /dev/uhid DAC, so a logged-in user granted this userspace-HID node can execute the complete create, reply, and destroy sequence without administrator privileges.\nUI:N - The attacker's process creates the emulated wireless controller, supplies the crafted feature reply and connection event, destroys it, and accesses the lingering power-supply object; no victim action is required.\nS:U - The freed steam_device, its embedded power_supply_desc, and the resulting callback execution all reside under the host kernel's security authority; no VM, IOMMU, or separate sandbox boundary is crossed.\nC:H - steam_battery_register() passes &steam->battery_desc and steam as power-supply state, but vulnerable steam_unregister() returns on empty serial_no; UHID destruction frees steam while readable power-supply properties retain both dangling pointers, enabling attacker-groomed kernel-memory reads.\nI:H - __power_supply_get_property() later dereferences the freed descriptor and indirectly calls psy->desc->get_property; reclaiming the devm allocation with controlled UHID descriptor data can replace that function pointer, enabling control-flow hijacking and arbitrary writes.\nA:H - Reading the lingering steam-controller--battery capacity attribute reaches power_supply_show_property() and dereferences the freed descriptor or callback, causing an oops or panic; the attacker can repeat the UHID create-and-destroy sequence."}]}],"providerMetadata":{"dateUpdated":"2026-10-26T06:56:53.861Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/3c2f97343d4df2a75747f4c79effa0587509888f"},{"url":"https://git.kernel.org/stable/c/2b15e10aff95c78dbacc4fa32fa90c9098213e03"},{"url":"https://git.kernel.org/stable/c/cf71a6ee1d4e36b8e65b81c064e2797a10247280"},{"url":"https://git.kernel.org/stable/c/c06cf54fe99b8c6bcf2017bb076c0e3918608cea"},{"url":"https://git.kernel.org/stable/c/6f9b740c31ba7e061b2ebb330d9a3d63f1358f29"}],"title":"HID: steam: Refactor registration","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-98944","datePublished":"2026-10-23T12:19:02.560Z","dateReserved":"2026-09-25T10:25:14.381Z","dateUpdated":"2026-10-26T06:56:53.861Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-23 13:17:15","lastModifiedDate":"2026-10-26 07:17:18","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"98944","Ordinal":"1","Title":"HID: steam: Refactor registration","CVE":"CVE-2026-98944","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"98944","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: steam: Refactor registration\n\nThis refactors and simplifies the registration/unregistration flow. Since\nwe now only perform registration when the client isn't opened anymore, the\nlogic for handling that can be removed, and the rest of the function\nstreamlined.\n\nWe also remove the previous assumption that we have a serial number to show\nwe're registered, replacing it with a single purpose boolean.\n\nIn a previous refactor the code for unregistering a battery if later\nregistration steps failed was accidentally left out. As a result, a\nlingering power_supply object could get left over after the steam object\nwas torn down. This is also fixed here.","Type":"Description","Title":"HID: steam: Refactor registration"}]}}}