LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49984: HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report It is possible for a malicious device to forgo submitting a Feature Report. The HID Steam driver presently makes no prevision for this and de-references the 'struct hid_report' pointer obtained from the HID devices without first checking its validity. Let's change that.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

A malicious HID device can make the Linux Steam Controller driver handle missing report data incorrectly, causing a NULL pointer dereference. In practical terms, this is most concerning for Linux systems that accept untrusted peripherals, where the likely business impact is disruption rather than data theft based on the provided sources.

Executive priority

Treat this as a targeted reliability risk for Linux endpoints exposed to untrusted devices, not as confirmed widespread exploitation. Patch through normal kernel maintenance, faster where physical peripheral access is hard to control.

Technical view

The Linux HID Steam driver dereferenced a struct hid_report pointer in steam_recv_report and steam_send_report without validating that a Feature Report existed. The kernel fix adds validity checks before use. The source bundle does not provide CVSS, CWE, or detailed impact beyond the NULL pointer dereference condition.

Likely exposure

Exposure is likely limited to Linux systems with the HID Steam driver reachable by a malicious or malformed HID device. Systems that do not permit untrusted peripherals, or do not use the affected driver path, have lower practical exposure.

Exploitation context

The bundle says exploitation requires a malicious device that omits a Feature Report. It does not cite public exploit activity, and KEV is false, so active exploitation should not be assumed.

Researcher notes

The provided evidence supports a NULL pointer dereference in the Linux HID Steam driver due to missing Feature Report validation. Version data in the bundle should be mapped against distribution-specific kernels because vendors may backport fixes without changing upstream version numbers.

Mitigation direction

  • Review kernel vendor advisories for your supported distribution and branch.
  • Apply stable kernel updates containing the referenced HID Steam fixes.
  • Restrict untrusted HID peripherals on sensitive Linux systems.
  • Prioritize shared workstations, kiosks, labs, and developer machines with peripheral access.

Validation and detection

  • Inventory Linux kernel versions and distribution backport status.
  • Check whether the HID Steam driver is present or enabled.
  • Confirm kernel packages include the referenced stable commits or vendor equivalents.
  • Review device-control policy for untrusted HID peripherals.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49984 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc164d6abf3841ffacfdb757c10616f9cb1f67276, c164d6abf3841ffacfdb757c10616f9cb1f67276, c164d6abf3841ffacfdb757c10616f9cb1f67276, c164d6abf3841ffacfdb757c10616f9cb1f67276, c164d6abf3841ffacfdb757c10616f9cb1f67276, c164d6abf3841ffacfdb757c10616f9cb1f67276unaffected
LinuxLinux4.18, 0, 4.19.257, 5.4.212, 5.10.141, 5.15.65, 5.19.7, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.