{"id":"CVE-2026-98945","kind":"vulnerability","aliases":["CVE-2026-98945"],"related":[],"title":"Linux kernel Steam HID driver: teardown race leaves dangling pointer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: steam: Rearrange teardown sequence\n\nThis fixes a narrow window during the teardown sequence where callbacks\ncould still be scheduled during cleanup that would then have a dangling\npointer to the now-freed steam struct.\n\nThis also puts work canceling for rumble and mode switch in\nsteam_unregister, as that shouldn't persist while the client hdev is open.","summary":"The Linux kernel's Steam controller HID driver could schedule callbacks during teardown that then pointed at already-freed memory. The fix reorders cleanup and cancels rumble and mode-switch work during unregistration.","severity":"unknown","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hid","infrastructure","kernel","linux","steam-controller"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-23T13:17:15+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:57:57+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T04:57:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel Steam HID driver: teardown race leaves dangling pointer","impact":"medium","summary":"The Linux kernel's Steam controller HID driver could schedule callbacks during teardown that then pointed at already-freed memory. The fix reorders cleanup and cancels rumble and mode-switch work during unregistration.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","steam-controller","hid"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the upstream kernel commit and NVD entry for the affected kernel version ranges and whether an attacker can trigger the race from a USB device.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000506,"input_tokens":3357,"output_tokens":340,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98945':13A,16A 'alreadi':42B 'already-fre':41B 'also':106C 'callback':34B,84C 'cancel':50B,109C 'cleanup':48B,90C 'client':125C 'control':23B,29B 'could':32B,85C 'cve':11A,14A 'dangl':9A,96C 'driver':5A,31B 'fix':46B,75C 'follow':64C 'freed':43B,102C 'hdev':126C 'hid':4A,17B,30B,69C 'infrastructur':18B 'kernel':2A,19B,26B,62C 'leav':8A 'linux':1A,20B,25B,61C 'memori':44B 'mode':54B,113C 'mode-switch':53B 'narrow':77C 'now-fre':100C 'open':128C 'persist':122C 'point':39B 'pointer':10A,97C 'put':107C 'race':7A 'rearrang':71C 'reorder':47B 'resolv':68C 'rumbl':51B,111C 'schedul':33B,88C 'sequenc':73C,82C 'shouldn':120C 'steam':3A,22B,28B,70C,103C,116C 'steam-control':21B 'still':86C 'struct':104C 'switch':55B,114C 'teardown':6A,36B,72C,81C 'unregist':117C 'unregistr':58B 'vulner':65C 'window':78C 'work':56B,108C 'would':92C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98945","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98945","severity":null,"published_at":"2026-10-23T13:17:15+00:00","modified_at":"2026-10-23T13:17:15+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98945","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98945","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}