Input Device Verification Flaw in Linux Kernel Affecting DualSense Controllers

CVE-2026-64478

What is CVE-2026-64478?

A vulnerability in the Linux kernel's USB audio subsystem, specifically related to DualSense controllers, allows for improper verification of input devices during a rapid disconnect-reconnect cycle. The flaw occurs in the jack-detection input handler, where the system verifies that a matching input device corresponds to the same physical controller by building kobject path strings. However, if the USB device gets disconnected, this process can lead to a fault in the strlen() function, ultimately posing a risk to system stability. This issue can be bypassed by modifying the ownership check to use parent chain comparisons rather than kobject path strings, enhancing the resilience of the verification process without exposing the system to potential faults.

References