CVE-2026-64478 - Vulnerability Details

- ALSA: usb-audio: avoid kobject path lookup in DualSense match

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: avoid kobject path lookup in DualSense match

The DualSense jack-detection input handler verifies that a matching input
device belongs to the same physical controller by building kobject path
strings for both the input device and the USB audio device, then comparing
the path prefix.

This was observed when a weak physical connection caused the controller
to rapidly disconnect and reconnect. During that repeated hotplug,
snd_dualsense_ih_match() can run while the controller's USB device is
being disconnected. kobject_get_path() walks ancestor kobjects and
dereferences their names; if the USB device kobject name is no longer
valid, this can fault in strlen():

RIP: 0010:strlen+0x10/0x30
Call Trace:
kobject_get_path+0x34/0x150
snd_dualsense_ih_match+0x49/0xd0 [snd_usb_audio]
input_register_device+0x566/0x6a0
ps_probe+0xb89/0x1590 [hid_playstation]

The same ownership check can be done without building kobject path
strings. The input device is parented below the HID device, USB interface
and USB device, so walking the input device parent chain and comparing
against the mixer USB device preserves the check without dereferencing
kobject names during disconnect.

Published: 2026-07-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability occurs in the ALSA USB audio driver when a DualSense controller disconnects and reconnects rapidly. The driver compares an input device to its original USB partner by building kobject path strings. During a hot‑plug event, the USB kobject may be removed while the path comparison runs, leading to an invalid string being passed to strlen. This causes a kernel fault and a system reboot, delivering a denial‑of‑service failure. The flaw involves a use‑after‑free scenario combined with a misuse of kernel object names.

Affected Systems

Affected systems are Linux kernel builds that contain the ALSA usb‑audio DualSense jack‑detection code before the patch that eliminates the path lookup. The vulnerability is present in all kernels that have not incorporated the commit series referenced in the advisory, so it applies to any distribution using an unpatched kernel.

Risk and Exploitability

Risk is moderate. The CVSS score of 5.5 indicates above‑average severity for a kernel race condition, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA KEV. The most likely attack vector is local; an attacker must induce a rapid disconnect/reconnect of a DualSense controller, which could trigger a kernel panic and reboot. No public exploit is known. Applying the patch removes the unnecessary path lookup and eliminates the race condition, preventing kernel crashes until the system is updated.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d0b0264009596c07a77d82808b0dae72bc04ac5c`	affected	< e4c66a149c408e44e60bfec3fabf08b6b7abbc60
`b4b94f092f193d7a2db8e82af5e51519ae89963c`	affected	< 4566bf8ae9dbfe81bdc2ff1702d59db8a233b06e
`c2d5b0a6c688ffb32c35627e337fbbcc65bc275f`	affected	< 662a1d7b5affc424ea4f4bc20dd99be29e687886
`d04d301614630724feb4048bf17432fc7964fe74`	affected	< a47ecd904c51ae6a42957feb3cf2f4266adee2e5
`a705899ec6085b12a33aa0fd94a58e82e9e90502`	affected	< c1da6d3f45036fa63672ee04ad97cb526b40b987
`79d561c4ec0497669f19a9550cfb74812f60938b`	affected	< a263eb12cbe2e208e6e637df0f9b0be9a484158e
`79d561c4ec0497669f19a9550cfb74812f60938b`	affected	< 4246dd043b7a4f8e3bc1d2896e81d11220610eda
`79d561c4ec0497669f19a9550cfb74812f60938b`	affected	< 7693c0cc415f3a16a7a3355f245474a5e661be4e
`104ad9bae11ee450fb7d0595ff7876cfb6527838`	affected	—
`0105cfc41abeb428d4405951a20e1e239bea5e1d`	affected	—
`5.10.245`	affected	< 5.10.261
`5.15.194`	affected	< 5.15.212
`6.1.155`	affected	< 6.1.178
`6.6.109`	affected	< 6.6.145
`6.12.50`	affected	< 6.12.96
`5.4.300`	affected	< 5.5
`6.16.10`	affected	< 6.17

Linux

affected

Version	Status	Constraints
`6.17`	affected	—
`0`	unaffected	< 6.17
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[d0b0264009596c07a77d82808b0dae72bc04ac5c,e4c66a149c408e44e60bfec3fabf08b6b7abbc60)`	affected	code_commit	—
`[b4b94f092f193d7a2db8e82af5e51519ae89963c,4566bf8ae9dbfe81bdc2ff1702d59db8a233b06e)`	affected	code_commit	—
`[c2d5b0a6c688ffb32c35627e337fbbcc65bc275f,662a1d7b5affc424ea4f4bc20dd99be29e687886)`	affected	code_commit	—
`[d04d301614630724feb4048bf17432fc7964fe74,a47ecd904c51ae6a42957feb3cf2f4266adee2e5)`	affected	code_commit	—
`[a705899ec6085b12a33aa0fd94a58e82e9e90502,c1da6d3f45036fa63672ee04ad97cb526b40b987)`	affected	code_commit	—
`[79d561c4ec0497669f19a9550cfb74812f60938b,a263eb12cbe2e208e6e637df0f9b0be9a484158e)`	affected	code_commit	—
`[79d561c4ec0497669f19a9550cfb74812f60938b,4246dd043b7a4f8e3bc1d2896e81d11220610eda)`	affected	code_commit	—
`[79d561c4ec0497669f19a9550cfb74812f60938b,7693c0cc415f3a16a7a3355f245474a5e661be4e)`	affected	code_commit	—
`104ad9bae11ee450fb7d0595ff7876cfb6527838`	affected	code_commit	—
`0105cfc41abeb428d4405951a20e1e239bea5e1d`	affected	code_commit	—
`[5.10.245,5.10.261)`	affected	semver	—
`[5.15.194,5.15.212)`	affected	semver	—
`[6.1.155,6.1.178)`	affected	semver	—
`[6.6.109,6.6.145)`	affected	semver	—
`[6.12.50,6.12.96)`	affected	semver	—
`[5.4.300,5.5)`	affected	generic	—
`[6.16.10,6.17)`	affected	generic	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.17`	affected	semver	—
`[0,6.17)`	unaffected	semver	—
`[5.10.261,5.10.*]`	unaffected	generic	—
`[5.15.212,5.15.*]`	unaffected	generic	—
`[6.1.178,6.1.*]`	unaffected	generic	—
`[6.6.145,6.6.*]`	unaffected	generic	—
`[6.12.96,6.12.*]`	unaffected	generic	—
`[6.18.39,6.18.*]`	unaffected	generic	—
`[7.1.4,7.1.*]`	unaffected	generic	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the kernel to a version that includes the patch removing the kobject path lookup.
Boot the updated kernel and reload the ALSA modules so the change takes effect.
If a kernel upgrade is not immediately possible, avoid rapid hot‑plug of DualSense controllers and monitor kernel logs for any crash events so that the system can be rebooted promptly.

Generated by OpenCVE AI on August 5, 2026 at 00:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4717-1	linux security update
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00184.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/4246dd043b7a4f8e3bc1d2896e81d11220610eda
https://git.kernel.org/stable/c/4566bf8ae9dbfe81bdc2ff1702d59db8a233b06e
https://git.kernel.org/stable/c/662a1d7b5affc424ea4f4bc20dd99be29e687886
https://git.kernel.org/stable/c/7693c0cc415f3a16a7a3355f245474a5e661be4e
https://git.kernel.org/stable/c/a263eb12cbe2e208e6e637df0f9b0be9a484158e
https://git.kernel.org/stable/c/a47ecd904c51ae6a42957feb3cf2f4266adee2e5
https://git.kernel.org/stable/c/c1da6d3f45036fa63672ee04ad97cb526b40b987
https://git.kernel.org/stable/c/e4c66a149c408e44e60bfec3fabf08b6b7abbc60
https://lore.kernel.org/linux-cve-announce/2026072547-CVE-2026-64478-2795@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64478
https://www.cve.org/CVERecord?id=CVE-2026-64478

History

Wed, 05 Aug 2026 00:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-416

Mon, 03 Aug 2026 19:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-476 CWE-590

Wed, 29 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026072547-CVE-2026-64478-2795@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64478 https://www.cve.org/CVERecord?id=CVE-2026-64478
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 26 Jul 2026 01:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476 CWE-590

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: avoid kobject path lookup in DualSense match The DualSense jack-detection input handler verifies that a matching input device belongs to the same physical controller by building kobject path strings for both the input device and the USB audio device, then comparing the path prefix. This was observed when a weak physical connection caused the controller to rapidly disconnect and reconnect. During that repeated hotplug, snd_dualsense_ih_match() can run while the controller's USB device is being disconnected. kobject_get_path() walks ancestor kobjects and dereferences their names; if the USB device kobject name is no longer valid, this can fault in strlen(): RIP: 0010:strlen+0x10/0x30 Call Trace: kobject_get_path+0x34/0x150 snd_dualsense_ih_match+0x49/0xd0 [snd_usb_audio] input_register_device+0x566/0x6a0 ps_probe+0xb89/0x1590 [hid_playstation] The same ownership check can be done without building kobject path strings. The input device is parented below the HID device, USB interface and USB device, so walking the input device parent chain and comparing against the mixer USB device preserves the check without dereferencing kobject names during disconnect.
Title		ALSA: usb-audio: avoid kobject path lookup in DualSense match
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/4246dd043b7a4f8e3bc1d2896e81d11220610eda https://git.kernel.org/stable/c/4566bf8ae9dbfe81bdc2ff1702d59db8a233b06e https://git.kernel.org/stable/c/662a1d7b5affc424ea4f4bc20dd99be29e687886 https://git.kernel.org/stable/c/7693c0cc415f3a16a7a3355f245474a5e661be4e https://git.kernel.org/stable/c/a263eb12cbe2e208e6e637df0f9b0be9a484158e https://git.kernel.org/stable/c/a47ecd904c51ae6a42957feb3cf2f4266adee2e5 https://git.kernel.org/stable/c/c1da6d3f45036fa63672ee04ad97cb526b40b987 https://git.kernel.org/stable/c/e4c66a149c408e44e60bfec3fabf08b6b7abbc60

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:51:40.299Z

Updated: 2026-07-25T08:51:40.299Z

Reserved: 2026-07-19T15:36:31.791Z

Link: CVE-2026-64478

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-07-25T10:17:33.350

Modified: 2026-07-25T10:17:33.350

Link: CVE-2026-64478

Redhat

Severity : Moderate

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64478 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-05T00:30:05Z

Weaknesses

CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object