CVE-2026-90328

A flaw was found in the Human Interface Device (HID) subsystem of the Linux kernel, specifically within the Steam Controller driver. This vulnerability arises because the driver trusts the message size encoded within Steam Controller FEATURE reports without verifying that the reported size matches the actual data read. A local attacker could potentially exploit this by providing a malformed report, leading to short reads and potentially causing a denial of service or other unspecified impacts due to unexpected data processing.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.