CVE-2026-90328: HID: steam: Reject short reads
In the Linux kernel, the following vulnerability has been resolved:
HID: steam: Reject short reads
Steam Controller FEATURE reports encode the size of the message in the message itself. Previously we were trusting that the size reported matched the size we actually read, leading to a potential issue with short reads. Instead, we should actually verify the length of the read.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.52 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.12-1Fixed in 7.2.14-1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel HID Steam driver and communicating with a Steam Controller through FEATURE reports are affected. The provided information does not identify specific kernel versions or configurations.
What condition is required to trigger the vulnerability?
A short read of a Steam Controller FEATURE report is required, where the message’s encoded size does not match the amount of data actually read. The issue resulted from trusting the size embedded in the report without verifying the received length.
How can I tell whether the fix is present?
Check whether your kernel includes the HID Steam change that rejects short reads and verifies the length of FEATURE reports. The provided stable-tree references identify commits f694ea0ead544080949e409a7c6885ee1fc77a98, 93c5cc35bcd9f62db589a21945b49691dccdd99d, and 33ff7b49c38b39b1f3d27db508ac0720fb25c08a.