CVE-2026-64487

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser

snd_usb_caiaq_tks4_dispatch() decodes the Traktor Kontrol S4 input

stream in fixed 16-byte (TKS4_MSGBLOCK_SIZE) message blocks. On every

iteration it advances buf and subtracts the block size while looping on

"while (len)".

len is urb->actual_length. That value is supplied by the device and is

not guaranteed to be a multiple of 16. When a final short block leaves

len between 1 and 15, the loop runs once more, reads up to buf[15], and

then does "len -= TKS4_MSGBLOCK_SIZE". As len is unsigned this underflows

to a huge value. The loop then keeps iterating and walking buf far past

the end of the 512-byte ep4_in_buf, reading out of bounds until a bogus

block id happens to be hit.

Iterate only while a full message block is available. This stops the

unsigned underflow and silently drops any trailing partial block, which

carries no complete control

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References