The vulnerability originates from the Linux kernel HID driver for Steam controllers trusting the size field of feature reports without verifying that the actual read length matched the declared size. Because a short read could occur, the driver would process incomplete or corrupted data, which could cause incorrect state handling, unpredictable behavior, or a kernel crash. The weakness is an input validation flaw that allows an attacker to supply truncated reports.

All Linux kernel versions prior to the commit that added read‑length verification (33ff7b49c38b39b1f3d27db508ac0720fb25c08a). Distributions that ship such kernels and expose Steam controller HID feature reports are affected. The device family is identified by the CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*.

The EPSS score is below 1 %, indicating that exploitation in the wild is unlikely. The vulnerability is not listed in CISA’s KEV catalog and no CVSS score is available, so severity remains indeterminate. Based on the description, a likely attack vector would involve an attacker providing truncated feature reports from a connected Steam controller or a malicious driver. The exploitability is limited to environments where a vulnerable kernel is attached to such a device.