HID: steam: Refactor registration

{
  "id": "bd6acd4aaaa150d58244d1890d96156af09b694a8cb9b9a4f444f301bb41186c",
  "url": "https://www.cve.org/CVERecord?id=CVE-2026-98944",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "HID: steam: Refactor registration",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: HID: steam: Refactor registration This refactors and simplifies the registration/unregistration flow. Since we now only perform registration when the client isn't opened anymore, the logic for handling that can be removed, and the rest of the function streamlined. We also remove the previous assumption that we have a serial number to show we're registered, replacing it with a single purpose boolean. In a previous refactor the code for unregistering a battery if later registration steps failed was accidentally left out. As a result, a lingering power_supply object could get left over after the steam object was torn down. This is also fixed here.",
    "evidence": "cve:CVE-2026-98944",
    "products": [
      {
        "name": {
          "value": "Linux",
          "evidence": "/containers/cna/affected/0/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      },
      {
        "name": {
          "value": "Linux",
          "evidence": "/containers/cna/affected/1/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-98944",
      "aliases": [
        "CVE-2026-98944"
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "version": "3.1",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - write() to /dev/uhid enters uhid_char_write() and uhid_dev_create2(), which accept attacker-chosen BUS_USB, Valve IDs, and descriptor; hid_add_device() binds steam_probe(), and an injected wireless-connect report reaches steam_raw_event(), steam_work_connect_cb(), and patched steam_register().\nAC:L - The attacker answers UHID_GET_REPORT for ID_GET_STRING_ATTRIBUTE with payload length 1 and the expected tag, so steam_get_serial() succeeds but leaves serial_no empty, then issues UHID_DESTROY; setup and teardown are attacker-controlled without a race or external condition.\nPR:L - Neither uhid_char_write() nor uhid_dev_create2() performs a capability check; access is governed only by /dev/uhid DAC, so a logged-in user granted this userspace-HID node can execute the complete create, reply, and destroy sequence without administrator privileges.\nUI:N - The attacker's process creates the emulated wireless controller, supplies the crafted feature reply and connection event, destroys it, and accesses the lingering power-supply object; no victim action is required.\nS:U - The freed steam_device, its embedded power_supply_desc, and the resulting callback execution all reside under the host kernel's security authority; no VM, IOMMU, or separate sandbox boundary is crossed.\nC:H - steam_battery_register() passes &steam->battery_desc and steam as power-supply state, but vulnerable steam_unregister() returns on empty serial_no; UHID destruction frees steam while readable power-supply properties retain both dangling pointers, enabling attacker-groomed kernel-memory reads.\nI:H - __power_supply_get_property() later dereferences the freed descriptor and indirectly calls psy->desc->get_property; reclaiming the devm allocation with controlled UHID descriptor data can replace that function pointer, enabling control-flow hijacking and arbitrary writes.\nA:H - Reading the lingering steam-controller--battery capacity attribute reaches power_supply_show_property() and dereferences the freed descriptor or callback, causing an oops or panic; the attacker can repeat the UHID create-and-destroy sequence."
            }
          ]
        }
      ],
      "affected": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "385a4886778f6d6e61eff1d4d295af332d7130e1",
              "lessThan": "3c2f97343d4df2a75747f4c79effa0587509888f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "385a4886778f6d6e61eff1d4d295af332d7130e1",
              "lessThan": "2b15e10aff95c78dbacc4fa32fa90c9098213e03",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "385a4886778f6d6e61eff1d4d295af332d7130e1",
              "lessThan": "cf71a6ee1d4e36b8e65b81c064e2797a10247280",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "385a4886778f6d6e61eff1d4d295af332d7130e1",
              "lessThan": "c06cf54fe99b8c6bcf2017bb076c0e3918608cea",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "385a4886778f6d6e61eff1d4d295af332d7130e1",
              "lessThan": "6f9b740c31ba7e061b2ebb330d9a3d63f1358f29",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "fb87a92b43961c89bf4a115d8a700885d8959cb1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4.19.6",
              "lessThan": "4.20",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "drivers/hid/hid-steam.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.20",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.113",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/hid/hid-steam.c"
          ],
          "defaultStatus": "affected"
        }
      ],
      "modified": "2026-10-26T06:56:53.861Z",
      "provider": "cve",
      "references": [
        "https://git.kernel.org/stable/c/3c2f97343d4df2a75747f4c79effa0587509888f",
        "https://git.kernel.org/stable/c/2b15e10aff95c78dbacc4fa32fa90c9098213e03",
        "https://git.kernel.org/stable/c/cf71a6ee1d4e36b8e65b81c064e2797a10247280",
        "https://git.kernel.org/stable/c/c06cf54fe99b8c6bcf2017bb076c0e3918608cea",
        "https://git.kernel.org/stable/c/6f9b740c31ba7e061b2ebb330d9a3d63f1358f29"
      ],
      "provider_metadata": {
        "cna": {
          "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "shortName": "Linux",
          "dateUpdated": "2026-10-26T06:56:53.861Z"
        }
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-98944",
        "evidence": "/cveMetadata/cveId"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/containers/cna/metrics"
  },
  "source_id": "core-cve",
  "document_id": 263379,
  "published_at": "2026-10-23T12:19:02.56+00:00"
}