Executive brief
The Linux kernel's Steam Controller HID driver did not properly validate the size of data read from the device, trusting only the size field encoded within the message itself. An attacker with physical access to a malicious or compromised Steam Controller could craft a short report to trigger unexpected behavior, potentially causing the system to read beyond valid buffer boundaries or process incomplete data, leading to denial of service or information disclosure.
Technical details
The vulnerability is an insufficient input validation flaw in the HID Steam driver (drivers/hid/hid-steam.c), specifically in the steam_recv_report() function. The driver received FEATURE reports from the Steam Controller and assumed the message size field in the payload matched the actual bytes read from the device. When a short read occurred, the driver would process truncated data without verification, potentially causing buffer over-read or NULL pointer dereference. The fix adds explicit validation: checking that at least 2 bytes were read for the header, and verifying that the actual read count matches or exceeds the size indicated by the message header (data[1] + 2 bytes). The attack requires physical access to present a malicious USB device or compromise an existing controller's firmware. A patch was merged upstream on 2026-07-29 and backported to stable kernel branches.
Affected products
- Linux Linux kernel all versions prior to commit 33ff7b49c38b39b1f3d27db508ac0720fb25c08a
Timeline
- 2026-09-17: disclosed: CVE-2026-90328 published
- 2026-07-29: patched: Fix committed upstream by Vicki Pfau
- 2026-08-03: other: Patch merged by Jiri Kosina