CVE-2026-64483

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: firewire: isight: bound the sample count to the packet payload

isight_packet() takes the frame count from the device iso packet and

checks it only against the device claimed iso length.

count = be32_to_cpu(payload->sample_count);

if (likely(count <= (length - 16) / 4))

isight_samples(isight, payload->samples, count);

length is the iso header data_length. It can be up to 0xffff. So the

gate allows a count up to about 16379. isight_samples() then copies

count frames out of payload->samples into the PCM DMA buffer.

payload->samples holds only 2 * MAX_FRAMES_PER_PACKET values. The

device multiplexes two samples per frame. A count past

MAX_FRAMES_PER_PACKET reads past the payload. A count past the buffer

size writes past runtime->dma_area. The smallest PCM buffer is larger

than MAX_FRAMES_PER_PACKET. Bounding the count to MAX_FRAMES_PER_PACKET

keeps both the read and the write in range.

A malicious or faulty

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References