CVE-2026-98945

The Linux kernel contains a vulnerability in the HID: steam component related to the teardown sequence. The issue involves a narrow window during cleanup where callbacks could still be scheduled, resulting in a dangling pointer to the freed steam struct . The fix involves rearranging the teardown...

EUVD-2026-108919

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Rearrange teardown sequence This fixes a narrow window during the teardown sequence where callbacks could still be scheduled during cleanup that would then have a dangling pointer to the now-freed steam struct. This...

CVE-2026-98944

The Linux kernel contains a vulnerability within the HID: steam driver related to an incomplete unregistration flow. Specifically, if registration steps failed, a power_supply object could remain lingering after the steam object was torn down. This issue was addressed by refactoring and simplifyi...

EUVD-2026-108917

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Clean up locking This cleans up several issues with locking behavior, including RCU accesses not being guarded behind a lock...

CVE-2026-98943

The Linux kernel contains a vulnerability within the HID: steam component related to improper locking behavior . Specifically, the issue involves RCU accesses that are not properly guarded behind a lock. The vulnerability has been addressed through a cleanup of these locking mechanisms. No specif...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Prevent NULL pointer dereferencing in steamrecv,sendreport It is possible for a malicious device to fail to submit a Feature Report. The HID Steam driver currently does not handle this situation and dereferences the...

SUSE CVE-2026-90328

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Reject short reads Steam Controller FEATURE reports encode the size of the message in the message itself. Previously we were trusting that the size reported matched the size we actually read, leading to a potential...

Linux Distros Unpatched Vulnerability : CVE-2026-90328

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: steam: Reject short reads Steam Controller FEATURE reports encode the size of the message in the message itself. Previously we were trusting that the size...

AZL-102203 CVE-2026-90328 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Reject short reads Steam Controller FEATURE reports encode the size of the message in the message itself. Previously we were trusting that the size reported matched the size we actually read, leading to a potential...

DEBIAN-CVE-2026-90328

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Reject short reads Steam Controller FEATURE reports encode the size of the message in the message itself. Previously we were trusting that the size reported matched the size we actually read, leading to a potential...

CVE-2026-90328 HID: steam: Reject short reads

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Reject short reads Steam Controller FEATURE reports encode the size of the message in the message itself. Previously we were trusting that the size reported matched the size we actually read, leading to a potential...

CVE-2026-90328

CVE-2026-90328 affects the Linux kernel 's HID Steam controller driver. The root cause is that FEATURE reports from the Steam Controller encode the message size within the report itself, but the driver previously trusted that the reported size matched the actual number of bytes read , without ver...

CVE-2026-90328 HID: steam: Reject short reads

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Reject short reads Steam Controller FEATURE reports encode the size of the message in the message itself. Previously we were trusting that the size reported matched the size we actually read, leading to a potential...

PT-2026-94676

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the HID steam driver where Steam Controller FEATURE reports encode the message size within the message itself. The system previously trusted that the reported size...

Azure Linux 3.0 Security Update: kernel (CVE-2025-21923)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21923 advisory. - In the Linux kernel, the following vulnerability has been resolved: HID: hid-steam: Fix use-after-free when...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992923)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992923 advisory. In the Linux kernel, the following vulnerability has been resolved: HID: steam: Prevent NULL pointer dereference in steamrecv,sendreport It is possible for a malicio...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992263)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992263 advisory. In the Linux kernel, the following vulnerability has been resolved: HID: steam: Prevent NULL pointer dereference in steamrecv,sendreport It is possible for a malicio...

EUVD-2025-9398

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2022-49984

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: HID: steam: Prevent NULL pointer dereference in steamrecv,sendreport It is possible for a...

CVE-2022-49984

A flaw was found in the hid-steam module in the Linux kernel. A NULL pointer dereference can be triggered when a malicious device fails to submit a feature report, resulting in a denial of service...