CVE-2022-49984: Linux Kernel

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report It is possible for a malicious device to forgo submitting a Feature Report. The HID Steam driver presently makes no prevision for this and de-references the 'struct hid_report' pointer obtained from the HID devices without first checking its validity. Let's change that.

Affected products

• Linux Linux Kernel: from 4.18, before 4.19.257 (fixed in 4.19.257); from 4.20, before 5.4.212 (fixed in 5.4.212); from 5.5, before 5.10.141 (fixed in 5.10.141); from 5.11, before 5.15.65 (fixed in 5.15.65); from 5.16, before 5.19.7 (fixed in 5.19.7); version 6.0 only

Published 2025-06-18. Last modified 2026-06-17.