High 7.8Published Oct 23, 2026

CVE-2026-98945HID: steam: Rearrange teardown sequence

Updated under an hour ago (Oct 26, 2026, 8:50 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.21%, higher than 11% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Rearrange teardown sequence This fixes a narrow window during the teardown sequence where callbacks could still be scheduled during cleanup that would then have a dangling pointer to the now-freed steam struct. This also puts work canceling for rumble and mode switch in steam_unregister, as that shouldn't persist while the client hdev is open.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.21% (percentile 11)
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 26, 2026
First seen by InfoSec Signals: Oct 23, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 9cd61c8179781344315c2a9816977ea415c5459e before d2587923d50c8b141ce0ccb284c714cf6054d6a7; from 9cd61c8179781344315c2a9816977ea415c5459e before 81a8209c09f9be7eef860ca6cc154749a6b4d243; from 9cd61c8179781344315c2a9816977ea415c5459e before 86724f4bcf6049c3a322f7a7b1f968210059c46a; from 9cd61c8179781344315c2a9816977ea415c5459e before b5ea938ff776306798d3a11485c2475034f92131; from 9cd61c8179781344315c2a9816977ea415c5459e before ddce9641ce924ed91ec8304577e463823a29ffaf	CNA record

References

References

https://git.kernel.org/stable/c/d2587923d50c8b141ce0ccb284c714cf6054d6a7
https://git.kernel.org/stable/c/81a8209c09f9be7eef860ca6cc154749a6b4d243
https://git.kernel.org/stable/c/86724f4bcf6049c3a322f7a7b1f968210059c46a
https://git.kernel.org/stable/c/b5ea938ff776306798d3a11485c2475034f92131
https://git.kernel.org/stable/c/ddce9641ce924ed91ec8304577e463823a29ffaf

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.