CVE-2026-64478

ALSA: usb-audio: avoid kobject path lookup in DualSense match

Published Jul 25, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: avoid kobject path lookup in DualSense match

The DualSense jack-detection input handler verifies that a matching input
device belongs to the same physical controller by building kobject path
strings for both the input device and the USB audio device, then comparing
the path prefix.

This was observed when a weak physical connection caused the controller
to rapidly disconnect and reconnect. During that repeated hotplug,
snd_dualsense_ih_match() can run while the controller's USB device is
being disconnected. kobject_get_path() walks ancestor kobjects and
dereferences their names; if the USB device kobject name is no longer
valid, this can fault in strlen():

RIP: 0010:strlen+0x10/0x30
Call Trace:
kobject_get_path+0x34/0x150
snd_dualsense_ih_match+0x49/0xd0 [snd_usb_audio]
input_register_device+0x566/0x6a0
ps_probe+0xb89/0x1590 [hid_playstation]

The same ownership check can be done without building kobject path
strings. The input device is parented below the HID device, USB interface
and USB device, so walking the input device parent chain and comparing
against the mixer USB device preserves the check without dereferencing
kobject names during disconnect.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d0b0264009596c07a77d82808b0dae72bc04ac5c`	affected	< e4c66a149c408e44e60bfec3fabf08b6b7abbc60
`b4b94f092f193d7a2db8e82af5e51519ae89963c`	affected	< 4566bf8ae9dbfe81bdc2ff1702d59db8a233b06e
`c2d5b0a6c688ffb32c35627e337fbbcc65bc275f`	affected	< 662a1d7b5affc424ea4f4bc20dd99be29e687886
`d04d301614630724feb4048bf17432fc7964fe74`	affected	< a47ecd904c51ae6a42957feb3cf2f4266adee2e5
`a705899ec6085b12a33aa0fd94a58e82e9e90502`	affected	< c1da6d3f45036fa63672ee04ad97cb526b40b987
`79d561c4ec0497669f19a9550cfb74812f60938b`	affected	< a263eb12cbe2e208e6e637df0f9b0be9a484158e
`79d561c4ec0497669f19a9550cfb74812f60938b`	affected	< 4246dd043b7a4f8e3bc1d2896e81d11220610eda
`79d561c4ec0497669f19a9550cfb74812f60938b`	affected	< 7693c0cc415f3a16a7a3355f245474a5e661be4e
`104ad9bae11ee450fb7d0595ff7876cfb6527838`	affected	—
`0105cfc41abeb428d4405951a20e1e239bea5e1d`	affected	—
`5.10.245`	affected	< 5.10.261
`5.15.194`	affected	< 5.15.212
`6.1.155`	affected	< 6.1.178
`6.6.109`	affected	< 6.6.145
`6.12.50`	affected	< 6.12.96
`5.4.300`	affected	< 5.5
`6.16.10`	affected	< 6.17

Linux

affected

Version	Status	Constraints
`6.17`	affected	—
`0`	unaffected	< 6.17
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[d0b0264009596c07a77d82808b0dae72bc04ac5c,e4c66a149c408e44e60bfec3fabf08b6b7abbc60)`	affected	code_commit	—
`[b4b94f092f193d7a2db8e82af5e51519ae89963c,4566bf8ae9dbfe81bdc2ff1702d59db8a233b06e)`	affected	code_commit	—
`[c2d5b0a6c688ffb32c35627e337fbbcc65bc275f,662a1d7b5affc424ea4f4bc20dd99be29e687886)`	affected	code_commit	—
`[d04d301614630724feb4048bf17432fc7964fe74,a47ecd904c51ae6a42957feb3cf2f4266adee2e5)`	affected	code_commit	—
`[a705899ec6085b12a33aa0fd94a58e82e9e90502,c1da6d3f45036fa63672ee04ad97cb526b40b987)`	affected	code_commit	—
`[79d561c4ec0497669f19a9550cfb74812f60938b,a263eb12cbe2e208e6e637df0f9b0be9a484158e)`	affected	code_commit	—
`[79d561c4ec0497669f19a9550cfb74812f60938b,4246dd043b7a4f8e3bc1d2896e81d11220610eda)`	affected	code_commit	—
`[79d561c4ec0497669f19a9550cfb74812f60938b,7693c0cc415f3a16a7a3355f245474a5e661be4e)`	affected	code_commit	—
`104ad9bae11ee450fb7d0595ff7876cfb6527838`	affected	code_commit	—
`0105cfc41abeb428d4405951a20e1e239bea5e1d`	affected	code_commit	—
`[5.10.245,5.10.261)`	affected	semver	—
`[5.15.194,5.15.212)`	affected	semver	—
`[6.1.155,6.1.178)`	affected	semver	—
`[6.6.109,6.6.145)`	affected	semver	—
`[6.12.50,6.12.96)`	affected	semver	—
`[5.4.300,5.5)`	affected	generic	—
`[6.16.10,6.17)`	affected	generic	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.17`	affected	semver	—
`[0,6.17)`	unaffected	semver	—
`[5.10.261,5.10.*]`	unaffected	generic	—
`[5.15.212,5.15.*]`	unaffected	generic	—
`[6.1.178,6.1.*]`	unaffected	generic	—
`[6.6.145,6.6.*]`	unaffected	generic	—
`[6.12.96,6.12.*]`	unaffected	generic	—
`[6.18.39,6.18.*]`	unaffected	generic	—
`[7.1.4,7.1.*]`	unaffected	generic	—
`[7.2-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4717-1	linux security update
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package
Ubuntu USN	USN-8726-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8727-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8760-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8726-2	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8726-3	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8800-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8760-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8726-4	Linux kernel vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8876-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8875-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8877-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8875-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8917-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8918-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.184% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://git.kernel.org/stable/c/4246dd043b7a4f8e3bc1d2896e81d11220610eda
https://git.kernel.org/stable/c/4566bf8ae9dbfe81bdc2ff1702d59db8a233b06e
https://git.kernel.org/stable/c/662a1d7b5affc424ea4f4bc20dd99be29e687886
https://git.kernel.org/stable/c/7693c0cc415f3a16a7a3355f245474a5e661be4e
https://git.kernel.org/stable/c/a263eb12cbe2e208e6e637df0f9b0be9a484158e
https://git.kernel.org/stable/c/a47ecd904c51ae6a42957feb3cf2f4266adee2e5
https://git.kernel.org/stable/c/c1da6d3f45036fa63672ee04ad97cb526b40b987
https://git.kernel.org/stable/c/e4c66a149c408e44e60bfec3fabf08b6b7abbc60
https://lore.kernel.org/linux-cve-announce/2026072547-CVE-2026-64478-2795@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64478
https://www.cve.org/CVERecord?id=CVE-2026-64478

History

Nov 12, 2026 6:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo

Nov 7, 2026 7:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 5, 2026 12:45 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-416

Aug 3, 2026 7:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-476 CWE-590

Jul 29, 2026 12:15 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026072547-CVE-2026-64478-2795@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64478 https://www.cve.org/CVERecord?id=CVE-2026-64478
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Jul 26, 2026 1:30 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-476 CWE-590

Jul 25, 2026 9:30 AM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: avoid kobject path lookup in DualSense match The DualSense jack-detection input handler verifies that a matching input device belongs to the same physical controller by building kobject path strings for both the input device and the USB audio device, then comparing the path prefix. This was observed when a weak physical connection caused the controller to rapidly disconnect and reconnect. During that repeated hotplug, snd_dualsense_ih_match() can run while the controller's USB device is being disconnected. kobject_get_path() walks ancestor kobjects and dereferences their names; if the USB device kobject name is no longer valid, this can fault in strlen(): RIP: 0010:strlen+0x10/0x30 Call Trace: kobject_get_path+0x34/0x150 snd_dualsense_ih_match+0x49/0xd0 [snd_usb_audio] input_register_device+0x566/0x6a0 ps_probe+0xb89/0x1590 [hid_playstation] The same ownership check can be done without building kobject path strings. The input device is parented below the HID device, USB interface and USB device, so walking the input device parent chain and comparing against the mixer USB device preserves the check without dereferencing kobject names during disconnect.
Title		ALSA: usb-audio: avoid kobject path lookup in DualSense match
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/4246dd043b7a4f8e3bc1d2896e81d11220610eda https://git.kernel.org/stable/c/4566bf8ae9dbfe81bdc2ff1702d59db8a233b06e https://git.kernel.org/stable/c/662a1d7b5affc424ea4f4bc20dd99be29e687886 https://git.kernel.org/stable/c/7693c0cc415f3a16a7a3355f245474a5e661be4e https://git.kernel.org/stable/c/a263eb12cbe2e208e6e637df0f9b0be9a484158e https://git.kernel.org/stable/c/a47ecd904c51ae6a42957feb3cf2f4266adee2e5 https://git.kernel.org/stable/c/c1da6d3f45036fa63672ee04ad97cb526b40b987 https://git.kernel.org/stable/c/e4c66a149c408e44e60bfec3fabf08b6b7abbc60