Cloudanix VulnDB

CVE-2026-98944

High · 7.8

CVSS

7.8

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the way Linux handles certain gaming device connections could let someone with access to the computer take over the whole system.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free condition in the Linux kernel HID steam driver where a power_supply object can remain after the parent steam object is destroyed, enabling memory corruption in kernel space.

Why it matters to the business

Systems running affected Linux kernels with Steam-related HID devices face elevated risk of local kernel compromise, which could lead to full system takeover, data theft, or denial of service; recent publication means patches may not yet be widely deployed.

How an attack unfolds

A local attacker with low privileges triggers the registration/unregistration path in the steam HID driver, leaving a dangling power_supply reference that is later dereferenced, resulting in use-after-free memory corruption that can be leveraged for privilege escalation.

How to fix it

Apply the kernel patch that refactors steam registration to use a single boolean flag and ensures battery power_supply objects are always unregistered; rebuild and deploy updated kernel packages to all affected systems.

How to confirm the fix worked

Confirm the fix by inspecting the steam HID driver source for the boolean registration flag and explicit power_supply unregister calls on failure paths; test by exercising device connect/disconnect sequences and verifying no lingering sysfs power_supply entries remain after module teardown.

Typical attack path

  1. Gain local user access on a Linux system with the vulnerable steam HID module loaded
  2. Interact with Steam controller or compatible HID device to exercise registration logic
  3. Trigger the incomplete unregistration path that omits battery power_supply cleanup
  4. Reuse the freed memory object to corrupt kernel structures and escalate privileges

How to detect it

Review kernel logs for oops or warnings involving power_supply or steam unregister paths; search audit logs for unexpected process crashes or privilege changes following HID device interactions.

What your security team should do

  • Prioritize kernel updates on all Linux endpoints within the next 30 days due to local privilege escalation potential
  • Audit systems for presence of the steam HID module and restrict access to gaming peripherals where possible
  • Monitor kernel update channels for backports to supported LTS branches

The record

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Refactor registration This refactors and simplifies the registration/unregistration flow. Since we now only perform registration when the client isn't opened anymore, the logic for handling that can be removed, and the rest of the function streamlined. We also remove the previous assumption that we have a serial number to show we're registered, replacing it with a single purpose boolean. In a previous refactor the code for unregistering a battery if later registration steps failed was accidentally left out. As a result, a lingering power_supply object could get left over after the steam object was torn down. This is also fixed here.

Affected packages

Ecosystem Package Introduced Fixed