CVE-2026-64478
Received Received - Intake

USB Audio Stack Kernel Use-After-Free in Linux Kernel

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: avoid kobject path lookup in DualSense match The DualSense jack-detection input handler verifies that a matching input device belongs to the same physical controller by building kobject path strings for both the input device and the USB audio device, then comparing the path prefix. This was observed when a weak physical connection caused the controller to rapidly disconnect and reconnect. During that repeated hotplug, snd_dualsense_ih_match() can run while the controller's USB device is being disconnected. kobject_get_path() walks ancestor kobjects and dereferences their names; if the USB device kobject name is no longer valid, this can fault in strlen(): RIP: 0010:strlen+0x10/0x30 Call Trace: kobject_get_path+0x34/0x150 snd_dualsense_ih_match+0x49/0xd0 [snd_usb_audio] input_register_device+0x566/0x6a0 ps_probe+0xb89/0x1590 [hid_playstation] The same ownership check can be done without building kobject path strings. The input device is parented below the HID device, USB interface and USB device, so walking the input device parent chain and comparing against the mixer USB device preserves the check without dereferencing kobject names during disconnect.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-08-14
AI Q&A
2026-07-25
EPSS Evaluated
2026-08-13
NVD
CVE-2026-64478
EUVD
EUVD-2026-48822

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the DualSense jack-detection input handler. It occurs when the handler builds kobject path strings to verify if an input device matches the physical controller. During rapid disconnects and reconnects of the controller, the handler may run while the USB device is being disconnected, leading to a fault in strlen() due to invalid kobject name dereferencing.

Detection Guidance

This vulnerability is specific to the Linux kernel's ALSA USB audio driver and DualSense controller handling. Detection requires checking kernel logs for related errors during USB device hotplug events. Monitor dmesg for kernel oops or warnings about strlen faults in snd_dualsense_ih_match or input_register_device.

Impact Analysis

This vulnerability can cause system crashes or instability when a DualSense controller rapidly disconnects and reconnects. It may lead to kernel faults, potentially disrupting audio or input device functionality on affected systems.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue related to USB audio device handling that could cause system instability during hardware disconnections. No data exposure or privacy concerns are associated with this flaw.

Mitigation Strategies

Update your Linux kernel to a patched version that resolves this issue. If immediate patching is not possible, avoid using DualSense controllers or disable the snd_usb_audio module until the fix is applied. Monitor kernel updates from your distribution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64478. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart