{"id":"CVE-2026-98945","summary":"HID: steam: Rearrange teardown sequence","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: steam: Rearrange teardown sequence\n\nThis fixes a narrow window during the teardown sequence where callbacks\ncould still be scheduled during cleanup that would then have a dangling\npointer to the now-freed steam struct.\n\nThis also puts work canceling for rumble and mode switch in\nsteam_unregister, as that shouldn't persist while the client hdev is open.","modified":"2026-10-28T02:36:38.005342573Z","published":"2026-10-23T12:19:04.191Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98945.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/81a8209c09f9be7eef860ca6cc154749a6b4d243"},{"type":"WEB","url":"https://git.kernel.org/stable/c/86724f4bcf6049c3a322f7a7b1f968210059c46a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b5ea938ff776306798d3a11485c2475034f92131"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d2587923d50c8b141ce0ccb284c714cf6054d6a7"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ddce9641ce924ed91ec8304577e463823a29ffaf"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98945.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98945"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"9cd61c8179781344315c2a9816977ea415c5459e"},{"fixed":"d2587923d50c8b141ce0ccb284c714cf6054d6a7"},{"fixed":"81a8209c09f9be7eef860ca6cc154749a6b4d243"},{"fixed":"86724f4bcf6049c3a322f7a7b1f968210059c46a"},{"fixed":"b5ea938ff776306798d3a11485c2475034f92131"},{"fixed":"ddce9641ce924ed91ec8304577e463823a29ffaf"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-98945.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.0"},{"fixed":"6.6.160"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.113"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.57"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.11"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-98945.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}