CVE-2026-64487
Received Received - Intake

Buffer Overflow in Linux Kernel ALSA caiaq Driver

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser snd_usb_caiaq_tks4_dispatch() decodes the Traktor Kontrol S4 input stream in fixed 16-byte (TKS4_MSGBLOCK_SIZE) message blocks. On every iteration it advances buf and subtracts the block size while looping on "while (len)". len is urb->actual_length. That value is supplied by the device and is not guaranteed to be a multiple of 16. When a final short block leaves len between 1 and 15, the loop runs once more, reads up to buf[15], and then does "len -= TKS4_MSGBLOCK_SIZE". As len is unsigned this underflows to a huge value. The loop then keeps iterating and walking buf far past the end of the 512-byte ep4_in_buf, reading out of bounds until a bogus block id happens to be hit. Iterate only while a full message block is available. This stops the unsigned underflow and silently drops any trailing partial block, which carries no complete control value anyway. The sibling endpoint-4 parsers are not affected. The Traktor Kontrol X1 and Maschine arms in snd_usb_caiaq_ep4_reply_dispatch() floor urb->actual_length before dispatching.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64487
EUVD
EUVD-2026-48831

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds read flaw in the Linux kernel's ALSA subsystem, specifically in the Traktor Kontrol S4 input parser. It occurs when processing USB audio device input. The parser reads fixed 16-byte blocks but fails to validate that the input length is a multiple of 16. When a short final block (1-15 bytes) remains, an unsigned integer underflow causes the parser to read far beyond the allocated buffer, potentially exposing sensitive memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's ALSA caiaq driver for Traktor Kontrol S4 devices. Detection requires checking if the affected driver is loaded and if the system is using a vulnerable kernel version. Inspect loaded kernel modules with 'lsmod | grep snd_usb_caiaq' and check kernel version with 'uname -r'. If the module is loaded and the kernel is vulnerable, the system is affected.

Impact Analysis

This vulnerability could allow an attacker with physical or USB device access to read sensitive kernel memory. This might expose passwords, encryption keys, or other confidential data. It could also crash the system or enable further exploits. However, exploitation requires a malicious USB device or compromised peripheral.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves this issue. If updating is not immediately possible, unload the snd_usb_caiaq module with 'modprobe -r snd_usb_caiaq' to disable the vulnerable driver. Avoid using Traktor Kontrol S4 devices until the system is updated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64487. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart