CVE-2026-64478: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64478 Overview

CVE-2026-64478 is a Linux kernel vulnerability in the ALSA USB audio driver's DualSense jack-detection input handler. The flaw occurs when snd_dualsense_ih_match() calls kobject_get_path() on a USB device that is concurrently being disconnected. During rapid controller hotplug events, the kobject name can become invalid, causing strlen() to fault while walking ancestor kobjects. The upstream fix replaces the kobject path string comparison with a parent-chain walk that does not dereference kobject names during disconnect.

Critical Impact
A physically weak USB connection to a Sony DualSense controller can trigger a kernel fault in the snd_usb_audio module, leading to a denial-of-service condition on affected Linux systems.

Affected Products

Linux kernel — ALSA snd_usb_audio driver (DualSense jack-detection path)
Linux kernel — hid_playstation driver interaction during ps_probe() and input_register_device()
Stable kernel branches receiving backports referenced in the kernel.org stable commits

Discovery Timeline

2026-07-25 - CVE-2026-64478 published to the National Vulnerability Database (NVD)
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64478

Vulnerability Analysis

The vulnerability resides in the DualSense jack-detection input handler within the ALSA USB audio subsystem. To confirm that a matching input device belongs to the same physical controller as a mixer, the handler builds kobject path strings for both the input device and the USB audio device, then compares the path prefix. This design requires walking ancestor kobjects and dereferencing their name fields.

When a controller with a weak physical connection rapidly disconnects and reconnects, snd_dualsense_ih_match() can execute concurrently with USB device teardown. If the USB device kobject name has already been freed or invalidated, kobject_get_path() calls strlen() on a stale pointer and triggers a kernel fault. The reported call trace shows the fault reaching strlen+0x10/0x30 through kobject_get_path+0x34/0x150, snd_dualsense_ih_match+0x49/0xd0, input_register_device+0x566/0x6a0, and ps_probe+0xb89/0x1590.

Root Cause

The root cause is a race condition between input device registration and USB device disconnection combined with unsafe kobject name dereferencing. The handler assumes kobject ancestor names remain valid for the duration of the match, but USB disconnect can invalidate those names concurrently. This is a kernel driver use-after-free style fault reachable from an ordinary hotplug event rather than an attacker-controlled input.

Attack Vector

The fault is triggered by physical USB hotplug behavior of a Sony DualSense controller, not by network input. An adversary with physical access, or a user experiencing hardware faults such as a damaged cable, can induce repeated disconnect and reconnect cycles that race with snd_dualsense_ih_match(). The result is a kernel oops that can destabilize or crash the affected host. No remote exploitation path is described in the upstream commit message.

The kernel patch removes the kobject path string comparison entirely. Instead, the fix walks the input device's parent chain, which is anchored below the HID device, the USB interface, and the USB device, and compares the resulting USB device pointer against the mixer's USB device. This preserves the ownership check without dereferencing kobject names during disconnect. See the upstream fixes in Kernel Git Commit 4246dd0 and Kernel Git Commit e4c66a1.

Detection Methods for CVE-2026-64478

Indicators of Compromise

Kernel oops messages containing RIP: 0010:strlen+0x10/0x30 in the fault frame
Call traces referencing kobject_get_path, snd_dualsense_ih_match, input_register_device, and ps_probe from hid_playstation
Repeated USB disconnect and reconnect events for a DualSense controller in dmesg or journalctl -k

Detection Strategies

Monitor /var/log/kern.log, journalctl -k, and crash dump collectors for oops signatures that combine snd_usb_audio and hid_playstation frames.
Correlate USB hotplug events from udev with kernel faults to identify hardware-triggered race conditions on endpoints running vulnerable kernels.
Baseline the kernel version of managed Linux endpoints and flag systems running builds prior to the fix commits referenced by kernel.org.

Monitoring Recommendations

Ingest kernel logs into a centralized SIEM and alert on Oops or BUG: entries that reference snd_dualsense_ih_match or kobject_get_path.
Track USB device enumeration churn on shared workstations, kiosks, and gaming or media hosts where DualSense controllers are used.
Include kernel version inventory in vulnerability management scans to identify unpatched hosts across Linux distributions.

How to Mitigate CVE-2026-64478

Immediate Actions Required

Update affected Linux systems to a kernel build that includes the ALSA usb-audio DualSense match fix referenced in the kernel.org stable commits.
Reboot systems after kernel updates so the patched snd_usb_audio module is loaded in place of the vulnerable version.
Replace faulty USB cables or ports that cause repeated DualSense disconnect and reconnect cycles to reduce race exposure until patches are deployed.

Patch Information

The upstream fix has been merged and backported across multiple stable branches. Distribution vendors ship the corrected snd_usb_audio module through their standard kernel update channels. Reference commits include Kernel Git Commit 4246dd0, Kernel Git Commit 4566bf8, Kernel Git Commit 662a1d7, Kernel Git Commit 7693c0c, Kernel Git Commit a263eb1, Kernel Git Commit a47ecd9, Kernel Git Commit c1da6d3, and Kernel Git Commit e4c66a1.

Workarounds

Unload the hid_playstation and snd_usb_audio modules on systems that do not require DualSense audio functionality until a patched kernel is installed.
Restrict physical access to USB ports on shared or unattended Linux hosts to reduce the chance of an attacker inducing rapid controller hotplug.
Avoid connecting DualSense controllers over unreliable cables or hubs on unpatched systems to prevent triggering the disconnect race.

bash

# Verify running kernel and reload modules after patching
uname -r
modinfo snd_usb_audio | grep -E '^(filename|version|srcversion)'

# Temporary workaround: prevent auto-loading on hosts that do not need DualSense
echo 'blacklist hid_playstation' | sudo tee /etc/modprobe.d/blacklist-dualsense.conf
sudo modprobe -r hid_playstation snd_usb_audio