CVE-2026-98945None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: HID: steam: Rearrange teardown sequence This fixes a narrow window during the teardown sequence where callbacks could still be scheduled during cleanup that would then…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
In the Linux kernel, the following vulnerability has been resolved:
HID: steam: Rearrange teardown sequence
This fixes a narrow window during the teardown sequence where callbacks could still be scheduled during cleanup that would then have a dangling pointer to the now-freed steam struct.
This also puts work canceling for rumble and mode switch in steam_unregister, as that shouldn't persist while the client hdev is open.
Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < d2587923d50c8b141ce0ccb284c714cf6054d6a7Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 81a8209c09f9be7eef860ca6cc154749a6b4d243Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 86724f4bcf6049c3a322f7a7b1f968210059c46aLinux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < b5ea938ff776306798d3a11485c2475034f92131Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < ddce9641ce924ed91ec8304577e463823a29ffafLinux < 6.6.160Linux < 6.12.113Linux < 6.18.57Linux < 7.2.11Linux (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99001Nonedrm/xe/i2c: cancel the client work on remove
CVE-2026-98989Nonenamespace: check a recursive bind mount for mount namespace loops
CVE-2026-98988Nonenamespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
CVE-2026-98992Nonenamespace: don't copy an unmounted mount tree
CVE-2026-98991Nonenamespace: queue a mount only once for mount notifications
CVE-2026-98990Nonenamespace: check a submount for references right before unmounting it