Use-After-Free Vulnerability in Linux Kernel HID: hid-steam Package
Summary
DEBIAN-CVE-2025-21923: In the Linux kernel, the following vulnerability has been resolved: HID: hid-steam: Fix use-after-free when detaching device When a hid-steam device is removed it must clean up the client_hdev used for intercepting hidra... Affects linux versions < 6.12.19-1. Fixed in 6.12.19-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. The 'hid-steam' module is responsible for handling input devices, particularly those related to gaming. This module allows for the management of HID (Human Interface Device) devices, enabling seamless communication between the device and the operating system. However, it is susceptible to vulnerabilities that can compromise system stability and security.
Vulnerability Detail
In the Linux kernel, a use-after-free vulnerability was identified in the hid-steam module. This issue arises when a hid-steam device is removed, leading to improper cleanup of the client_hdev used for intercepting hidraw access. The deferred work intended to reattach the input device can be rescheduled even after the cleanup cancels it, potentially leading to system crashes or unexpected behavior. This vulnerability can be exploited by an attacker to execute arbitrary code or cause a denial of service.
How To Fix
Minimum fixed version
6.12.19-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid detaching hid-steam devices until the patch is applied. This can help mitigate the risk of exploitation until the system is updated.
Conclusion
The use-after-free vulnerability in the Linux kernel's hid-steam module poses significant risks to system stability and security. It is crucial for users to update their systems to the patched version to mitigate these risks. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
A use-after-free vulnerability occurs when a program continues to use a pointer after the memory it points to has been freed, potentially leading to arbitrary code execution or crashes.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The risks include potential system crashes, unauthorized access, and execution of arbitrary code, which can compromise the integrity and security of the system.
Yes, the vulnerability is fixed in version 6.12.19-1 of the Linux package.
If immediate updates are not possible, avoid using the affected hid-steam devices until the patch is applied to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
