CVE-2026-64487 is a vulnerability in Linux Kernel
Published on July 25, 2026
ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
In the Linux kernel, the following vulnerability has been resolved:
ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
snd_usb_caiaq_tks4_dispatch() decodes the Traktor Kontrol S4 input
stream in fixed 16-byte (TKS4_MSGBLOCK_SIZE) message blocks. On every
iteration it advances buf and subtracts the block size while looping on
"while (len)".
len is urb->actual_length. That value is supplied by the device and is
not guaranteed to be a multiple of 16. When a final short block leaves
len between 1 and 15, the loop runs once more, reads up to buf[15], and
then does "len -= TKS4_MSGBLOCK_SIZE". As len is unsigned this underflows
to a huge value. The loop then keeps iterating and walking buf far past
the end of the 512-byte ep4_in_buf, reading out of bounds until a bogus
block id happens to be hit.
Iterate only while a full message block is available. This stops the
unsigned underflow and silently drops any trailing partial block, which
carries no complete control value anyway.
The sibling endpoint-4 parsers are not affected. The Traktor Kontrol X1
and Maschine arms in snd_usb_caiaq_ep4_reply_dispatch() floor
urb->actual_length before dispatching.
Products Associated with CVE-2026-64487
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 15c5ab607045e278ebf4d2ca4aea2250617d50ca and below de5f9edc705497b1b2c6b173b22f283486d2fd91 is affected.
- Version 15c5ab607045e278ebf4d2ca4aea2250617d50ca and below 70d6d4cfa4ad09688aed2ec8a0cfa72c31f60334 is affected.
- Version 15c5ab607045e278ebf4d2ca4aea2250617d50ca and below 884f575cc6acb136eb4a161d925147f85b59c27e is affected.
- Version 15c5ab607045e278ebf4d2ca4aea2250617d50ca and below 05df59b9a61f7ca66548df079d306c41da23845d is affected.
- Version 15c5ab607045e278ebf4d2ca4aea2250617d50ca and below 3cad86197c7bf8b45bb1d8adc1099d0913e80469 is affected.
- Version 15c5ab607045e278ebf4d2ca4aea2250617d50ca and below a5fd3122283bf75c04f6414bf610100beb0565b0 is affected.
- Version 15c5ab607045e278ebf4d2ca4aea2250617d50ca and below 0680413f2f10aab43878dd3db711a6a9e45bab7c is affected.
- Version 15c5ab607045e278ebf4d2ca4aea2250617d50ca and below f7f3f9fd81e7adbaa12c2e62ee07f0e094a543fd is affected.
- Version 2.6.37 is affected.
- Before 2.6.37 is unaffected.
- Version 5.10.261, <= 5.10.* is unaffected.
- Version 5.15.212, <= 5.15.* is unaffected.
- Version 6.1.178, <= 6.1.* is unaffected.
- Version 6.6.145, <= 6.6.* is unaffected.
- Version 6.12.96, <= 6.12.* is unaffected.
- Version 6.18.39, <= 6.18.* is unaffected.
- Version 7.1.4, <= 7.1.* is unaffected.
- Version 7.2-rc1, <= * is unaffected.