In the Linux kernel, the following vulnerability has been resolved: HID: steam: Refactor registration This refactors and simplifies the… (CVE-2026-98944)

The Linux kernel's HID steam driver had a vulnerability due to incomplete unregistration logic. Specifically, during a previous refactor, the code responsible for unregistering a battery if later registration steps failed was accidentally omitted. This omission could cause a lingering power_supply object to remain after the steam object was torn down. The recent fix refactors and simplifies the registration/unregistration flow by performing registration only when the client is no longer open, removing unnecessary logic, and replacing the serial number assumption with a boolean flag. This resolves the issue by ensuring proper cleanup and preventing resource leakage.

The vulnerability could result in a lingering power_supply object after the steam device is torn down, potentially causing resource leakage or inconsistent device state within the kernel. There is no indication of direct security compromise such as privilege escalation or code execution from the provided information.

A fix has been implemented in the Linux kernel to address this issue by refactoring the HID steam driver's registration and unregistration logic. Users should update to the fixed kernel version once it is released. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisory for the exact fixed version and apply the update accordingly.