Executive brief
A vulnerability in the Linux kernel's USB audio driver for Sony DualSense controllers can cause a system crash (kernel panic). This occurs when a controller has a poor physical connection that causes it to rapidly connect and disconnect. While this primarily affects availability by crashing the host system, it requires physical access to the device or a faulty hardware connection.
Technical details
A race condition exists in the `snd_dualsense_ih_match` function within the ALSA usb-audio subsystem. The DualSense jack-detection handler attempts to verify device ownership by calling `kobject_get_path` to build and compare path strings. If a controller is rapidly disconnected (e.g., due to a weak physical connection), `kobject_get_path` may attempt to dereference kobject names that are no longer valid during the disconnect process, leading to a crash in `strlen()`. The fix replaces kobject path string comparison with a direct walk of the device parent chain, which is safe during teardown. The vulnerability is addressed in multiple stable kernel branches.
Affected products
- Linux Linux Kernel 6.10, 6.6, 6.1, 5.15, 5.10, 5.4, 4.19
Timeline
- 2026-06-24: other: Patch submitted by developer
- 2026-07-24: patched: Patches committed to stable trees
- 2026-07-25: advisory: CVE published
References
- https://git.kernel.org/stable/c/4246dd043b7a4f8e3bc1d2896e81d11220610eda
- https://git.kernel.org/stable/c/4566bf8ae9dbfe81bdc2ff1702d59db8a233b06e
- https://git.kernel.org/stable/c/662a1d7b5affc424ea4f4bc20dd99be29e687886
- https://git.kernel.org/stable/c/7693c0cc415f3a16a7a3355f245474a5e661be4e
- https://git.kernel.org/stable/c/a263eb12cbe2e208e6e637df0f9b0be9a484158e
- https://git.kernel.org/stable/c/a47ecd904c51ae6a42957feb3cf2f4266adee2e5
- https://git.kernel.org/stable/c/c1da6d3f45036fa63672ee04ad97cb526b40b987