CVE-2026-90328 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution maintainers, and users of the Steam Controller on Linux systems should assess exposure and verify if their systems are affected. Those using Linux kernel versions prior to the fixed versions should prioritize remediation. Additionally, security teams and vulnerability management teams should review the vulnerability and its potential impact on their systems.

Why it matters

A vulnerability in the Linux kernel's HID steam driver could allow an attacker to trigger a short read, potentially causing issues with the Steam Controller. Linux kernel maintainers and users should assess exposure and verify if their systems are affected.

• Verify Linux kernel versions and configurations to ensure they are not affected
• Update to fixed Linux kernel versions if necessary to prevent potential issues with the Steam Controller

Technical summary

The Linux kernel's HID steam driver had a vulnerability where it did not properly verify the length of reads, potentially leading to short reads. This issue has been resolved by rejecting short reads. The vulnerability affects Linux kernel versions prior to the fixed versions. To address this issue, users should review their Linux kernel versions, update to fixed versions if necessary, and verify system configurations to ensure they are not affected. The vulnerability could allow an attacker to trigger a short read, potentially causing issues with the Steam Controller.

Defensive priority

Medium

Recommended defensive actions

• Review Linux kernel versions and compare with fixed versions
• Update to fixed Linux kernel versions if necessary
• Verify system configurations and Steam Controller usage
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. However, the CVSS score and severity are not provided. To verify exposure, defenders should review Linux kernel versions and configurations, check for Steam Controller usage, and assess potential impact on system security. The source details indicate a short read vulnerability in the HID steam driver, which could lead to issues with the Steam Controller. Further verification tasks include reviewing system logs and user

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.