{"id":"CVE-2026-98945","title":"HID: steam: Rearrange teardown sequence","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: steam: Rearrange teardown sequence\n\nThis fixes a narrow window during the teardown sequence where callbacks\ncould still be scheduled during cleanup that would then…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 9cd61c8179781344315c2a9816977ea415c5459e < d2587923d50c8b141ce0ccb284c714cf6054d6a7","Linux >= 9cd61c8179781344315c2a9816977ea415c5459e < 81a8209c09f9be7eef860ca6cc154749a6b4d243","Linux >= 9cd61c8179781344315c2a9816977ea415c5459e < 86724f4bcf6049c3a322f7a7b1f968210059c46a","Linux >= 9cd61c8179781344315c2a9816977ea415c5459e < b5ea938ff776306798d3a11485c2475034f92131","Linux >= 9cd61c8179781344315c2a9816977ea415c5459e < ddce9641ce924ed91ec8304577e463823a29ffaf","Linux 6.3"],"published":"2026-10-23","updated":"2026-10-26","sourceUpdated":"2026-10-26T06:56:55.094Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98945","references":[{"url":"https://git.kernel.org/stable/c/d2587923d50c8b141ce0ccb284c714cf6054d6a7"},{"url":"https://git.kernel.org/stable/c/81a8209c09f9be7eef860ca6cc154749a6b4d243"},{"url":"https://git.kernel.org/stable/c/86724f4bcf6049c3a322f7a7b1f968210059c46a"},{"url":"https://git.kernel.org/stable/c/b5ea938ff776306798d3a11485c2475034f92131"},{"url":"https://git.kernel.org/stable/c/ddce9641ce924ed91ec8304577e463823a29ffaf"}],"tags":["cve.org"],"epss":0.00163,"epssPercentile":0.05457,"ingestedAt":"2026-10-23T13:24:55.558Z","slug":"CVE-2026-98945","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nHID: steam: Rearrange teardown sequence\n\nThis fixes a narrow window during the teardown sequence where callbacks\ncould still be scheduled during cleanup that would then have a dangling\npointer to the now-freed steam struct.\n\nThis also puts work canceling for rumble and mode switch in\nsteam_unregister, as that shouldn't persist while the client hdev is open.\n\n## Affected\n\n- `Linux >= 9cd61c8179781344315c2a9816977ea415c5459e < d2587923d50c8b141ce0ccb284c714cf6054d6a7`\n- `Linux >= 9cd61c8179781344315c2a9816977ea415c5459e < 81a8209c09f9be7eef860ca6cc154749a6b4d243`\n- `Linux >= 9cd61c8179781344315c2a9816977ea415c5459e < 86724f4bcf6049c3a322f7a7b1f968210059c46a`\n- `Linux >= 9cd61c8179781344315c2a9816977ea415c5459e < b5ea938ff776306798d3a11485c2475034f92131`\n- `Linux >= 9cd61c8179781344315c2a9816977ea415c5459e < ddce9641ce924ed91ec8304577e463823a29ffaf`\n- `Linux 6.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":228900,"id":"CVE-2026-98945","ts":1792854104397,"field":"cvss","old":null,"new":"7.8"},{"seq":228899,"id":"CVE-2026-98945","ts":1792854104397,"field":"severity","old":"none","new":"high"}]}