{"id":"CVE-2026-98945","title":"HID: steam: Rearrange teardown sequence","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: steam: Rearrange teardown sequence\n\nThis fixes a narrow window during the teardown sequence where callbacks\ncould still be scheduled during cleanup that would then…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < d2587923d50c8b141ce0ccb284c714cf6054d6a7","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 81a8209c09f9be7eef860ca6cc154749a6b4d243","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 86724f4bcf6049c3a322f7a7b1f968210059c46a","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < b5ea938ff776306798d3a11485c2475034f92131","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < ddce9641ce924ed91ec8304577e463823a29ffaf","Linux < 6.6.160","Linux < 6.12.113","Linux < 6.18.57","Linux < 7.2.11","Linux (all versions)"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T12:19:04.191Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98945","references":[{"url":"https://git.kernel.org/stable/c/d2587923d50c8b141ce0ccb284c714cf6054d6a7"},{"url":"https://git.kernel.org/stable/c/81a8209c09f9be7eef860ca6cc154749a6b4d243"},{"url":"https://git.kernel.org/stable/c/86724f4bcf6049c3a322f7a7b1f968210059c46a"},{"url":"https://git.kernel.org/stable/c/b5ea938ff776306798d3a11485c2475034f92131"},{"url":"https://git.kernel.org/stable/c/ddce9641ce924ed91ec8304577e463823a29ffaf"}],"tags":["cve.org"],"ingestedAt":"2026-10-23T13:24:55.558Z","slug":"CVE-2026-98945","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nHID: steam: Rearrange teardown sequence\n\nThis fixes a narrow window during the teardown sequence where callbacks\ncould still be scheduled during cleanup that would then have a dangling\npointer to the now-freed steam struct.\n\nThis also puts work canceling for rumble and mode switch in\nsteam_unregister, as that shouldn't persist while the client hdev is open.\n\n## Affected\n\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < d2587923d50c8b141ce0ccb284c714cf6054d6a7`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 81a8209c09f9be7eef860ca6cc154749a6b4d243`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 86724f4bcf6049c3a322f7a7b1f968210059c46a`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < b5ea938ff776306798d3a11485c2475034f92131`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < ddce9641ce924ed91ec8304577e463823a29ffaf`\n- `Linux < 6.6.160`\n- `Linux < 6.12.113`\n- `Linux < 6.18.57`\n- `Linux < 7.2.11`\n- `Linux (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}