---
id: CVE-2026-90328
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  HID: steam: Reject short reads

  Steam Controller FEATURE reports encode the size of the message in the
  message itself
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  HID: steam: Reject short reads

  Steam Controller FEATURE reports encode the size of the message in the
  message itself. Previously we were trusting that the size reporte…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c164d6abf3841ffacfdb757c10616f9cb1f67276 <
    f694ea0ead544080949e409a7c6885ee1fc77a98
  - >-
    Linux >= c164d6abf3841ffacfdb757c10616f9cb1f67276 <
    93c5cc35bcd9f62db589a21945b49691dccdd99d
  - >-
    Linux >= c164d6abf3841ffacfdb757c10616f9cb1f67276 <
    33ff7b49c38b39b1f3d27db508ac0720fb25c08a
  - Linux 4.18
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:30.940'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90328'
references:
  - url: 'https://git.kernel.org/stable/c/33ff7b49c38b39b1f3d27db508ac0720fb25c08a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/93c5cc35bcd9f62db589a21945b49691dccdd99d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f694ea0ead544080949e409a7c6885ee1fc77a98'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.822Z'
epss: 0.00198
epssPercentile: 0.09866
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

HID: steam: Reject short reads

Steam Controller FEATURE reports encode the size of the message in the
message itself. Previously we were trusting that the size reported matched
the size we actually read, leading to a potential issue with short reads.
Instead, we should actually verify the length of the read.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.