CVE-2026-98944

HID: steam: Refactor registration

State: Published
Severity: 7.8 High
Published: Oct 23, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: steam: Refactor registration

This refactors and simplifies the registration/unregistration flow. Since we now only perform registration when the client isn't opened anymore, the logic for handling that can be removed, and the rest of the function streamlined.

We also remove the previous assumption that we have a serial number to show we're registered, replacing it with a single purpose boolean.

In a previous refactor the code for unregistering a battery if later registration steps failed was accidentally left out. As a result, a lingering power_supply object could get left over after the steam object was torn down. This is also fixed here.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	385a4886778f6d6e61eff1d4d295af332d7130e1 to before 6e44418d3a06f023877959cc6dd7386ec7f64d59Affected 385a4886778f6d6e61eff1d4d295af332d7130e1 to before bdfad7759fef1a5d8be9bacee3c72ce40f148b63Affected 385a4886778f6d6e61eff1d4d295af332d7130e1 to before 39568571aee4f5499a6d254812fe4b75dc3d4aceAffected 385a4886778f6d6e61eff1d4d295af332d7130e1 to before 3c2f97343d4df2a75747f4c79effa0587509888fAffected 385a4886778f6d6e61eff1d4d295af332d7130e1 to before 2b15e10aff95c78dbacc4fa32fa90c9098213e03Affected 385a4886778f6d6e61eff1d4d295af332d7130e1 to before cf71a6ee1d4e36b8e65b81c064e2797a10247280Affected 385a4886778f6d6e61eff1d4d295af332d7130e1 to before c06cf54fe99b8c6bcf2017bb076c0e3918608ceaAffected 385a4886778f6d6e61eff1d4d295af332d7130e1 to before 6f9b740c31ba7e061b2ebb330d9a3d63f1358f29Affected fb87a92b43961c89bf4a115d8a700885d8959cb1Affected 4.19.6 to before 4.20Affected
LinuxLinux	4.20Affected before 4.20Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.18.57 through 6.18.Not affected 7.2.11 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

385a4886778f6d6e61eff1d4d295af332d7130e1 to before 6e44418d3a06f023877959cc6dd7386ec7f64d59Affected
385a4886778f6d6e61eff1d4d295af332d7130e1 to before bdfad7759fef1a5d8be9bacee3c72ce40f148b63Affected
385a4886778f6d6e61eff1d4d295af332d7130e1 to before 39568571aee4f5499a6d254812fe4b75dc3d4aceAffected
385a4886778f6d6e61eff1d4d295af332d7130e1 to before 3c2f97343d4df2a75747f4c79effa0587509888fAffected
385a4886778f6d6e61eff1d4d295af332d7130e1 to before 2b15e10aff95c78dbacc4fa32fa90c9098213e03Affected
385a4886778f6d6e61eff1d4d295af332d7130e1 to before cf71a6ee1d4e36b8e65b81c064e2797a10247280Affected
385a4886778f6d6e61eff1d4d295af332d7130e1 to before c06cf54fe99b8c6bcf2017bb076c0e3918608ceaAffected
385a4886778f6d6e61eff1d4d295af332d7130e1 to before 6f9b740c31ba7e061b2ebb330d9a3d63f1358f29Affected
fb87a92b43961c89bf4a115d8a700885d8959cb1Affected
4.19.6 to before 4.20Affected

LinuxLinux

4.20Affected
before 4.20Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.18.57 through 6.18.*Not affected
7.2.11 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.