CVE-2026-98944HID: steam: Refactor registration
- 7.8HighCVSS base score
- 0.18%Exploitation in 30 daysEPSS · top 93% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: HID: steam: Refactor registration This refactors and simplifies the registration/unregistration flow. Since we now only perform registration when the client isn't opened anymore, the logic for handling that can be removed, and the rest of the function streamlined. We also remove the previous assumption that we have a serial number to show we're registered, replacing it with a single purpose boolean. In a previous refactor the code for unregistering a battery if later registration steps failed was accidentally left out. As a result, a lingering power_supply object could get left over after the steam object was torn down. This is also fixed here.
Timeline
ID reserved
By Linux
- 28 days later
· 28 days later
Published
- 7 days later
· 7 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.18% · top 93% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected 385a4886778f6d6e61eff1d4d295af332d7130e1 – < 6e44418d3a06f023877959cc6dd7386ec7f64d59
- affected 385a4886778f6d6e61eff1d4d295af332d7130e1 – < bdfad7759fef1a5d8be9bacee3c72ce40f148b63
- affected 385a4886778f6d6e61eff1d4d295af332d7130e1 – < 39568571aee4f5499a6d254812fe4b75dc3d4ace
- affected 385a4886778f6d6e61eff1d4d295af332d7130e1 – < 3c2f97343d4df2a75747f4c79effa0587509888f
- affected 385a4886778f6d6e61eff1d4d295af332d7130e1 – < 2b15e10aff95c78dbacc4fa32fa90c9098213e03
- affected 385a4886778f6d6e61eff1d4d295af332d7130e1 – < cf71a6ee1d4e36b8e65b81c064e2797a10247280
- affected 385a4886778f6d6e61eff1d4d295af332d7130e1 – < c06cf54fe99b8c6bcf2017bb076c0e3918608cea
- affected 385a4886778f6d6e61eff1d4d295af332d7130e1 – < 6f9b740c31ba7e061b2ebb330d9a3d63f1358f29
- affected fb87a92b43961c89bf4a115d8a700885d8959cb1
- affected 4.19.6 – < 4.20
- affected 4.20
- unaffected < 4.20
- unaffected 5.10.273 – ≤ 5.10.*
- unaffected 5.15.224 – ≤ 5.15.*
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.113 – ≤ 6.12.*
- unaffected 6.18.57 – ≤ 6.18.*
- unaffected 7.2.11 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References8
- https://git.kernel.org/stable/c/6e44418d3a06f023877959cc6dd7386ec7f64d59 (opens in a new tab)
- https://git.kernel.org/stable/c/bdfad7759fef1a5d8be9bacee3c72ce40f148b63 (opens in a new tab)
- https://git.kernel.org/stable/c/39568571aee4f5499a6d254812fe4b75dc3d4ace (opens in a new tab)
- https://git.kernel.org/stable/c/3c2f97343d4df2a75747f4c79effa0587509888f (opens in a new tab)
- https://git.kernel.org/stable/c/2b15e10aff95c78dbacc4fa32fa90c9098213e03 (opens in a new tab)
- https://git.kernel.org/stable/c/cf71a6ee1d4e36b8e65b81c064e2797a10247280 (opens in a new tab)
- https://git.kernel.org/stable/c/c06cf54fe99b8c6bcf2017bb076c0e3918608cea (opens in a new tab)
- https://git.kernel.org/stable/c/6f9b740c31ba7e061b2ebb330d9a3d63f1358f29 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-108918 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-98944)Record last updated .