CVE-2026-98945

What it actually does

Use-after-free in the steam HID driver where pending callbacks can dereference a dangling pointer to a freed steam struct during a narrow teardown window.

Why it matters to the business

Local attackers on Linux systems using Steam controllers or similar HID devices can trigger crashes or potential code execution, requiring urgent kernel updates on affected hosts.

How an attack unfolds

An attacker with local access forces device unregister while rumble or mode-switch work items remain scheduled, causing the callback to access already-freed memory in the steam struct.

How to fix it

Apply the upstream kernel patch that moves rumble and mode-switch work cancellation into steam_unregister and ensures no callbacks remain during cleanup; rebuild and reboot to the fixed kernel.

How to confirm the fix worked

Confirm the steam driver source contains work_cancel calls inside steam_unregister and that the teardown sequence prevents callback scheduling after free; test with device hot-unplug under load.

Typical attack path

1. Obtain local user access on a Linux host with the steam HID driver loaded
2. Trigger steam device open/close or unregister sequence under timing pressure
3. Schedule work that outlives the struct teardown to hit the dangling pointer
4. Leverage resulting UAF for memory corruption or denial of service

How to detect it

Review kernel logs for oops/panic entries referencing steam, hid, or workqueue callbacks after device removal; inspect for use-after-free reports in the HID subsystem.

What your security team should do

• Patch Linux kernels on all systems exposing the steam HID driver within the next maintenance window
• Restrict local access to hosts with gaming HID peripherals until updated
• Add kernel crash and HID subsystem logging to SIEM for post-patch validation