Linux Kernel EUVD-2026-108919

Exploitation requires the HID steam driver (CONFIG_HID_STEAM) to be loaded, which in practice means a Steam Controller or Steam Deck controller device is present and bound. The flaw is a use-after-free triggered in a narrow timing window during the driver teardown sequence, when callbacks (including rumble and mode-switch work) can still be scheduled against the freed steam struct; the exact attacker-controlled trigger is not described in the available sources. Limiting factors that reduce realistic risk: the attack vector is local (AV:L) and requires privileges per the supplied vector (PR:L, i.e. authentication requirements indicate a non-anonymous local actor), the race window is narrow, and the system must actually have the steam HID hardware/driver active - systems without this gaming-peripheral driver are not exposed.

Severity is genuinely high on paper (CVSS 7.8) but real-world urgency is moderate, and the signals are broadly consistent rather than conflicting. The supplied vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H describes a locally exploitable, low-privilege flaw with full confidentiality, integrity and availability impact - consistent with a kernel use-after-free leading to memory corruption and potential local privilege escalation. However, EPSS is only 0.21% (11th percentile), there is no CISA KEV listing, and no public exploit is identified, so widespread opportunistic exploitation is unlikely; the vuln.today priority of this_week (not act_now/emergency) matches that picture. One caveat: the supplied vector uses AC:L, yet the upstream description explicitly calls this a 'narrow window during the teardown sequence,' i.e. a timing-dependent race, so the practical attack complexity is higher than AC:L implies. Exposure is further bounded by the fact that the affected code is the HID steam driver, which is only active when Steam Controller/Steam Deck hardware is bound. CWE is listed as N/A; the class (use-after-free) is inferred from the description, not vendor-assigned. Net: a legitimate patch-this-week priority for systems that actually load this driver, not a drop-everything emergency.

On a system where the HID steam driver is loaded (a Steam Controller or Steam Deck controller is present/bound), a local user triggers the driver teardown sequence - for example by causing the device to detach while rumble or mode-switch work and other callbacks are still scheduled. In the narrow teardown window, one of those callbacks runs against the now-freed steam struct (use-after-free), corrupting kernel memory and potentially enabling local privilege escalation. No public exploit code is identified at time of analysis.