In the Linux kernel, the following vulnerability has been resolved: HID: steam: Rearrange teardown sequence This fixes a narrow window during the… (CVE-2026-98945)

The Linux kernel HID steam driver had a vulnerability caused by a race condition in the teardown sequence. During device cleanup, callbacks could still be scheduled that referenced a steam struct that had already been freed, resulting in dangling pointer usage. The patch rearranges the teardown sequence to close this narrow window and moves work canceling for rumble and mode switch into the steam_unregister function to prevent these operations from persisting while the client device is open.

This vulnerability could lead to use-after-free conditions in the Linux kernel HID steam driver, potentially causing kernel crashes or undefined behavior. No known exploits in the wild have been reported. The impact is limited to systems running the affected Linux kernel with the HID steam driver enabled.

A fix has been implemented in the Linux kernel to rearrange the teardown sequence and properly cancel work during device unregistration. Users should update to the patched Linux kernel version containing this fix once it is available. Patch status is not explicitly confirmed in the provided data; check the official Linux kernel advisories for the exact fixed versions and update accordingly.