CVE-2026-90328

CVE-2026-90328

published September 17, 2026

CVSS
—
EPSS
0%
Percentile
10.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

HID: steam: Reject short reads

Steam Controller FEATURE reports encode the size of the message in the

message itself. Previously we were trusting that the size reported matched

the size we actually read, leading to a potential issue with short reads.

Instead, we should actually verify the length of the read.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00209 · 10.5th percentile
Published
2026-09-17T21:17Z
References (5)
https://git.kernel.org/stable/c/33ff7b49c38b39b1f3d27db508ac0720fb25c08a · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/37cb84b992718924dc334ce584c703333a6a4217 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/93c5cc35bcd9f62db589a21945b49691dccdd99d · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cbcc9b0ccbbd33125ffc9479fb8f69ac969fe55c · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f694ea0ead544080949e409a7c6885ee1fc77a98 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 19 SEP 03:55Z
    EPSS moved — → 0%
    epss
  • 17 SEP 16:08Z
    HID: steam: Reject short reads
    cvelistv5