CVE-2026-64478

What it actually does

This vulnerability is a race condition in the Linux kernel ALSA USB audio handling for DualSense controllers. During rapid USB disconnect/reconnect events, the DualSense jack-detection input handler can compare device ownership by constructing kobject path strings while the underlying USB device is being torn down. If the USB device kobject name has already become invalid, the kernel can dereference stale or invalid memory during kobject_get_path(), faulting in strlen(). The practical technical result is a kernel crash or instability triggered during repeated hotplug of an affected USB controller/audio path, rather than remote code execution or privilege escalation based on currently available information.

Why it matters to the business

The main operational risk is denial of service: affected Linux systems may crash or become unstable when a DualSense controller or similar affected USB audio/HID path rapidly disconnects and reconnects, including from a bad cable, weak physical connection, or deliberate local manipulation. This is most relevant to Linux desktops, gaming systems, kiosks, lab machines, embedded systems, or workstations where USB peripherals are physically accessible. The issue is not listed in CISA KEV, has no known mature exploit, and has low EPSS, so broad internet-scale exploitation is unlikely; however, systems that depend on physical availability or unattended operation could still experience disruption.

How an attack unfolds

An attacker would need the ability to influence USB hotplug behavior on a vulnerable Linux system, typically through physical access to the machine or control over an attached USB device. They repeatedly connect and disconnect an affected DualSense controller or cause a flaky USB connection while the hid_playstation and snd_usb_audio paths are probing and registering input/audio devices. During this window, snd_dualsense_ih_match() may run while the associated USB device kobject is being dismantled. The vulnerable code calls kobject_get_path(), which walks ancestor kobjects and reads their names; if the USB device name has already become invalid, the kernel can fault in strlen(), producing an oops/panic depending on kernel settings. Successful exploitation results in local denial of service through kernel crash or degraded system stability.

How to fix it

Apply the Linux kernel update that contains the ALSA usb-audio DualSense fix, which avoids kobject path string lookup during the ownership check and instead walks the input device parent chain safely. Because no exact affected product list or fixed package versions were provided, use your Linux distribution's security advisories and kernel changelogs to identify the first fixed kernel package for CVE-2026-64478. Where immediate patching is not possible, reduce exposure by limiting physical USB access, avoiding use of affected DualSense controllers on critical systems, replacing unreliable USB cables/hubs, disabling unneeded USB ports where operationally feasible, and preventing automatic loading or use of the relevant PlayStation HID/USB audio functionality on systems that do not require it. Mitigations should be treated as temporary; the durable fix is a patched kernel.

How to confirm the fix worked

Confirm remediation by verifying the running kernel package includes the upstream fix for the ALSA usb-audio DualSense kobject path lookup issue. Check distribution security advisories, package changelogs, or source patches for references to avoiding kobject_get_path() in snd_dualsense_ih_match() or the commit titled "ALSA: usb-audio: avoid kobject path lookup in DualSense match." Reboot into the fixed kernel after installation and confirm the old vulnerable kernel is not still running. Operational validation can include connecting and disconnecting a DualSense controller under controlled test conditions and confirming there are no kernel oops, panic, or call traces involving strlen(), kobject_get_path(), snd_dualsense_ih_match(), hid_playstation, or snd_usb_audio. Do not perform aggressive hotplug stress testing on production systems unless maintenance windows and crash recovery are in place.

Typical attack path

1. Gain physical access to a vulnerable Linux system or control an attached USB device capable of repeated connect/disconnect behavior.
2. Attach a DualSense controller or affected USB HID/audio device path handled by hid_playstation and snd_usb_audio.
3. Rapidly disconnect and reconnect the device, or induce unstable USB signaling through a weak cable, hub, or malicious USB behavior.
4. Trigger concurrent USB device teardown and input/audio device registration paths.
5. Cause snd_dualsense_ih_match() to call kobject_get_path() while the USB device kobject name is invalid.
6. Crash or destabilize the kernel, causing denial of service.

How to detect it

Look for evidence of prior kernel faults, oopses, panics, or unexpected reboots correlated with USB hotplug events involving Sony PlayStation/DualSense controllers, hid_playstation, snd_usb_audio, or ALSA USB audio. Relevant log sources include the kernel ring buffer, system journal, syslog, distribution crash collectors, kdump/vmcore records, and endpoint telemetry that records device insert/remove events. Search for call traces containing strlen(), kobject_get_path(), snd_dualsense_ih_match(), input_register_device(), ps_probe(), snd_usb_audio, and hid_playstation. Also review USB disconnect/reconnect storms shortly before a crash, such as repeated USB device reset, disconnect, new device, or HID registration messages. There are no known public threat actors or ransomware campaigns associated with this issue, so detection should focus on local crash artifacts and repeated physical/device hotplug behavior rather than network indicators.

• RIP: 0010:strlen+0x10/0x30
• kobject_get_path+0x34/0x150
• snd_dualsense_ih_match+0x49/0xd0 [snd_usb_audio]
• input_register_device+0x566/0x6a0
• ps_probe+0xb89/0x1590 [hid_playstation]
• snd_dualsense_ih_match
• kobject_get_path
• hid_playstation
• snd_usb_audio
• ALSA: usb-audio
• DualSense
• Call Trace:
• kernel panic
• kernel oops
• usb disconnect
• new high-speed USB device
• new full-speed USB device

What your security team should do

• Prioritize patching Linux endpoints or appliances where users or attackers can physically access USB ports, especially kiosks, shared workstations, labs, and unattended systems.
• Inventory Linux systems that load hid_playstation and snd_usb_audio modules or commonly use DualSense controllers.
• Track vendor kernel advisories for CVE-2026-64478 and deploy the first fixed distribution kernel once available.
• Reboot systems after patching and verify they are running the fixed kernel, not only that the package is installed.
• Where patching is delayed, restrict physical USB access and disable unused USB ports or affected peripheral support on critical systems.
• Review kernel logs for historical crashes or oops traces matching this bug, especially on systems with unexplained reboots after USB device activity.
• Treat exploitation likelihood as low for remote attackers, but do not ignore the issue on systems where local denial of service has operational consequences.