CVE-2026-64478 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: avoid kobject path lookup in DualSense match
The DualSense jack-detection input handler verifies that a matching input device belongs to the same physical controller by building kobject path strings for both the input device and the USB audio device, then comparing the path prefix.
This was observed when a weak physical connection caused the controller to rapidly disconnect and reconnect. During that repeated hotplug, snd_dualsense_ih_match() can run while the controller's USB device is being disconnected. kobject_get_path() walks ancestor kobjects and dereferences their names; if the USB device kobject name is no longer valid, this can fault in strlen():
RIP: 0010:strlen+0x10/0x30 Call Trace: kobject_get_path+0x34/0x150 snd_dualsense_ih_match+0x49/0xd0 [snd_usb_audio]
input_register_device+0x566/0x6a0 ps_probe+0xb89/0x1590 [hid_playstation]
The same ownership check can be done without building kobject path strings. The input device is parented below the HID device, USB interface and USB device, so walking the input device parent chain and comparing against the mixer USB device preserves the check without dereferencing kobject names during disconnect.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
This vulnerability exists within the Linux kernel's ALSA USB audio subsystem where the DualSense controller jack-detection handler performs an improper validation of device ownership during hotplug events. The flaw occurs when a weak physical connection causes rapid disconnection and reconnection cycles of the PlayStation DualSense controller, creating a race condition that leads to system instability. The vulnerability stems from the function snd_dualsense_ih_match() which attempts to verify that an input device belongs to the same physical controller by constructing kobject path strings for both the input device and USB audio device, then comparing these paths. This approach becomes problematic when the USB device is in the process of being disconnected because the kobject_get_path() function traverses ancestor kobjects and dereferences their names, potentially accessing invalid memory locations.
The technical execution of this vulnerability involves a specific sequence where during repeated hotplug operations, the kernel's USB subsystem calls snd_dualsense_ih_match() while the controller's USB device is being disconnected. When kobject_get_path() attempts to walk up the ancestor kobjects and dereference their names, it encounters a situation where the USB device kobject name is no longer valid, causing a fault in the strlen() function. The call trace demonstrates this chain of execution starting from RIP: 0010:strlen+0x10/0x30 through kobject_get_path+0x34/0x150 to snd_dualsense_ih_match+0x49/0xd0 in the snd_usb_audio module, ultimately leading to input_register_device+0x566/0x6a0 and ps_probe+0xb89/0x1590 in the hid_playstation driver. This represents a classic race condition vulnerability where memory access occurs after object deletion or invalidation.
The operational impact of this vulnerability can manifest as system crashes, kernel oops, or complete system hangs when DualSense controllers experience intermittent connectivity issues. The vulnerability specifically affects systems running Linux kernels with ALSA USB audio support and PlayStation DualSense controller integration, making it particularly relevant for gaming platforms, streaming setups, and any environment where these controllers are used with Linux-based systems. The issue becomes more pronounced during periods of unstable physical connections or when users frequently plug in and out the controller, creating a window where the kernel's device management code can access freed memory structures.
The fix addresses this vulnerability by changing the ownership verification approach to avoid building kobject path strings entirely. Instead of constructing path comparisons that could fail during disconnection events, the solution leverages the existing parent-child relationship between devices in the kernel's device tree. Since input devices are properly parented below the HID device, USB interface, and USB device hierarchy, the validation can be performed by walking the input device parent chain and comparing against the mixer USB device directly without dereferencing potentially invalid kobject names during disconnect operations. This approach aligns with CWE-476 which addresses null pointer dereference vulnerabilities and follows ATT&CK technique T1543.003 for persistence via kernel modules, ensuring that device validation occurs in a safe memory context while maintaining the intended security properties of preventing cross-device ownership conflicts.
This vulnerability demonstrates the complexity of kernel-level device management where proper synchronization between hardware events, device tree traversal, and memory management must be carefully coordinated to prevent race conditions. The solution represents a defensive programming approach that eliminates the problematic code path rather than attempting to fix the race condition through additional locking mechanisms. The fix ensures that device ownership validation remains robust even under stress conditions such as rapid hotplug cycles or unstable physical connections, maintaining system stability while preserving the security checks necessary to prevent unauthorized device access. The resolution follows established kernel development practices for handling device tree relationships and demonstrates how understanding of kernel subsystems can lead to more resilient implementations that avoid dangerous memory access patterns during device lifecycle events.