CVE-2026-90328

What it actually does

The HID steam driver trusted the message length encoded in Steam Controller FEATURE reports without verifying it matched the actual bytes read from the device, allowing short reads to be processed as valid data.

Why it matters to the business

Systems using Steam Controllers may experience instability or crashes in input handling when malicious or faulty hardware sends truncated reports; low exploitability limits widespread operational risk.

How an attack unfolds

An attacker with local access to a Steam Controller device crafts FEATURE reports containing an encoded size larger than the bytes actually delivered, causing the kernel driver to operate on unverified or truncated buffers.

How to fix it

Apply the upstream kernel patch that adds explicit length verification on FEATURE report reads; rebuild and deploy the updated kernel module on affected systems.

How to confirm the fix worked

Confirm the fix by inspecting the steam driver source for the added length check or by verifying the running kernel contains the commit that rejects short reads.

Typical attack path

1. Attach or emulate a Steam Controller device
2. Send crafted FEATURE report with mismatched encoded vs actual length
3. Trigger the driver to process the short read without length validation
4. Cause memory corruption, denial of service, or information disclosure

How to detect it

Review kernel logs for HID steam driver warnings or errors around report length mismatches; examine dmesg or syslog for anomalies during controller initialization.

What your security team should do

• Prioritize kernel updates on systems with Steam Controller hardware attached
• Monitor for local privilege-escalation attempts involving HID devices
• Test input stability after patching in lab environments before broad rollout