The Linux kernel contains a use‑after‑free condition in the HID Steam driver where callbacks may be scheduled after the steam struct has already been freed. This creates a narrow window in the teardown sequence where a dangling pointer can be dereferenced, potentially allowing an attacker to trigger arbitrary kernel code execution. The flaw stems from improper cleanup of callbacks during driver unregistration, leading to memory corruption and kernel privilege escalation.

All Linux kernel builds that expose the HID Steam subsystem and lack the recent patch are vulnerable. The issue is not tied to a specific vendor; it applies broadly to Linux distributions shipping the kernel with the vulnerable driver. No version numbers are specified, so any kernel incorporating this driver before the patch is at risk.

The exploitability hinges on triggering the teardown sequence while callbacks remain scheduled, a scenario plausible through normal usage of Steam HID devices. The CVSS score of 7.8 signals high severity, though the EPSS score of < 1% indicates a low overall exploitation probability at present. The vulnerability is not listed in the CISA KEV catalog, but the potential for kernel-level remote code execution warrants prompt remediation.