EUVD-2026-108918
GHSA-x6f5-jpm5-3jpm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local access and attach/emulate Steam Controller
-
DeliveryHID steam driver begins registration
-
ExploitForce later registration step to fail
-
ExecutionTeardown leaves dangling power_supply object
-
PersistAccess freed kernel object
-
ImpactCorrupt kernel memory for privilege escalation
Vulnerability Assessment
| Exploitation Conditions | Requires the HID steam driver (CONFIG_HID_STEAM) to be present and a Valve Steam Controller device to be attached (physically or emulated as a local USB HID device), so exploitation is limited to local access with the driver and matching hardware/emulation in play. The defective state - a lingering power_supply object after the steam object is torn down - only occurs when a later registration step fails after the battery was already registered; this is an error path, and the available sources do not describe how an attacker would deterministically force that failure. Limiting factors: local-only vector, driver must be built/loaded, device must bind, and the trigger depends on the registration error path rather than normal operation. |
| Impact | Signals are consistent and point to a genuine but non-urgent local kernel memory-safety issue rather than an internet-facing emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local, low-privilege flaw with high confidentiality/integrity/availability impact - characteristic of a kernel use-after-free/dangling-object condition, here a power_supply object left over after the HID steam device is torn down. EPSS is low at 0.21% (10th percentile), there is no CISA KEV listing and no public exploit or PoC reference in the supplied data, so exploitation status is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_week,' indicating routine-but-prompt patching, not act_now/emergency. The low EPSS aligns with the lack of KEV/PoC and with the local attack vector: this is not a mass-exploitable remote bug. The main caveat is mechanism: the description says the leftover power_supply arises only when later registration steps fail, which is an error path and not described as attacker-controllable; whether a local user can reliably drive that failure is not stated in the available sources, so the real-world exploitability behind the 7.8 score is uncertain. No SSVC automatable/technical-impact fields were provided to cross-check. |
| Exploit ScenarioDerived | A local user attaches (or emulates via a crafted USB HID device) a Valve Steam Controller so the HID steam driver binds; if a registration step fails after the battery/power_supply object was already registered, the driver tears down the steam object while leaving a dangling power_supply, which a local attacker could potentially leverage for memory corruption in kernel context. No public exploit or PoC is identified in the available data, and the trigger depends on hitting the registration error path, which the sources do not describe as attacker-controlled. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 24, 2026
The HID Steam driver in the Linux kernel can leave a stale power_supply object registered after the steam device object has already been torn down, because the battery-unregistration step was accidentally dropped from a failure path during an earlier registration refactor. Local users on systems built with CONFIG_HID_STEAM and bound to Valve Steam Controller hardware (physical or emulated USB HID) are the only reachable population, and the assessed vector is AV:L/AC:H/PR:L/UI:N, meaning a local authenticated user plus an error condition that the available sources do not describe how to force deterministically. Vendor patches exist in 6.6.160, 6.12.113, 6.18.57, 7.2.11 and 7.3; EPSS is 0.21% (10th percentile), no KEV listing, and no public exploit code was identified at time of analysis, so this is a genuine but non-urgent local kernel memory-safety fix rather than an internet-facing emergency.
RemediationAI
Vendor-released patch: update to Linux 6.6.160, 6.12.113, 6.18.57, 7.2.11 or 7.3, or apply the corresponding stable commits listed in the CVE references (for example https://git.kernel.org/stable/c/3c2f97343d4df2a75747f4c79effa0587509888f and https://git.kernel.org/stable/c/2b15e10aff95c78dbacc4fa32fa90c9098213e03, with the remaining stable links covering the other branches). Patching is the complete fix because it restores battery unregistration on the failed-registration path and drops the serial-number assumption. Where an immediate kernel update is not possible, the exposure is confined to hosts that load the driver, so not building or not loading CONFIG_HID_STEAM (for example by blacklisting the module) removes the attack surface entirely; the trade-off is that Valve Steam Controller battery reporting and related HID functionality stop working until the module is re-enabled after patching. Restricting local logins is only a partial measure since the assessed vector requires local access (PR:L), and no public exploit code was identified at time of analysis, so prioritization should follow standard kernel patch cadence rather than emergency change control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the kernel's HID transport driver for the Valve Steam Controller (CONFIG_HID_STEAM), which registers a power_supply class device to expose the controller's battery to userspace. The upstream fix is a refactor of the registration/unregistration flow: registration is now performed only once the client is no longer open, the self-referential logic around that state is removed, and the previous assumption that a serial number indicates registration is replaced by a single-purpose boolean. Critically, an earlier refactor had accidentally removed the code that unregisters the battery if a later registration step failed, so a lingering power_supply object could survive teardown of the steam object and be left pointing at freed driver state. No CWE identifier is assigned in the supplied data, but the defect class described is a dangling/lifetime-management error on an error path. Exact affected builds are identified by CPE cpe:2.3:a:linux:linux, and the flaw only manifests when the driver is built and loaded, a matching HID device binds, and a post-battery registration step fails; the sources do not describe the trigger mechanism beyond that error path.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local driver bug needing a bound Steam Controller and a registration-failure error path that is not described as attacker-controlled, hence AV:L, PR:L and AC:H; full kernel impact gives C/I/A:H.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
HID: steam: Refactor registration
This refactors and simplifies the registration/unregistration flow. Since we now only perform registration when the client isn't opened anymore, the logic for handling that can be removed, and the rest of the function streamlined.
We also remove the previous assumption that we have a serial number to show we're registered, replacing it with a single purpose boolean.
In a previous refactor the code for unregistering a battery if later registration steps failed was accidentally left out. As a result, a lingering power_supply object could get left over after the steam object was torn down. This is also fixed here.
Executive ViewAI
CVE-2026-98944 is a high-severity but low-likelihood local kernel vulnerability affecting Linux systems with the HID Steam driver and Valve Steam Controller hardware, where a stale power_supply object can be left registered after device teardown. Impact is limited to local authenticated users on a narrow hardware population, and the error condition is difficult to force. Leadership should care only if the organization deploys such hardware in sensitive environments, as the risk of exploitation is currently minimal.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB