In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser… (CVE-2026-64487)
In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser snd_usb_caiaq_tks4_dispatch() decodes the Traktor Kontrol S4 input stream in fixed 16-byte (TKS4_MSGBLOCK_SIZE) message blocks. On every iteration it advances buf and subtracts the block size while looping on "while (len)". len is urb->actual_length. That value is supplied by the device and is not guaranteed to be a multiple of 16. When a final short block leaves len between 1 and 15, the loop runs once more, reads up to buf[15], and then does "len -= TKS4_MSGBLOCK_SIZE". As len is unsigned this underflows to a huge value. The loop then keeps iterating and walking buf far past the end of the 512-byte ep4_in_buf, reading out of bounds until a bogus block id happens to be hit. Iterate only while a full message block is available. This stops the unsigned underflow and silently drops any trailing partial block, which carries no complete control value anyway. The sibling endpoint-4 parsers are not affected. The Traktor Kontrol X1 and Maschine arms in snd_usb_caiaq_ep4_reply_dispatch() floor urb->actual_length before dispatching.
AI Analysis
Technical Summary
The Linux kernel ALSA caiaq driver function snd_usb_caiaq_tks4_dispatch() processes input streams from the Traktor Kontrol S4 device in fixed 16-byte blocks. The vulnerability arises because the length of the input data (urb->actual_length) is device-supplied and may not be a multiple of 16. When a final partial block of 1 to 15 bytes is present, the loop incorrectly continues, causing an unsigned underflow of the length variable and reading beyond the allocated 512-byte buffer. This results in an out-of-bounds read until an invalid block ID is encountered. The fix involves iterating only while a full 16-byte block is available, preventing the underflow and ignoring incomplete trailing data. Other related parsers for sibling endpoints are unaffected.
Potential Impact
The vulnerability allows an out-of-bounds read in kernel memory, which could potentially lead to information disclosure or kernel instability. However, no specific exploit or active exploitation in the wild is reported. The impact is limited to the ALSA caiaq driver handling the Traktor Kontrol S4 input stream.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this issue by modifying the input parser to process only complete 16-byte message blocks, preventing the out-of-bounds read. Users should apply the official Linux kernel updates that include this patch. Since this is a kernel-level vulnerability, updating the kernel to a fixed version is the recommended remediation. Patch status is not explicitly stated in the provided data; users should consult the vendor or Linux kernel advisory for the exact fixed versions and update accordingly.
In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser… (CVE-2026-64487)
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser snd_usb_caiaq_tks4_dispatch() decodes the Traktor Kontrol S4 input stream in fixed 16-byte (TKS4_MSGBLOCK_SIZE) message blocks. On every iteration it advances buf and subtracts the block size while looping on "while (len)". len is urb->actual_length. That value is supplied by the device and is not guaranteed to be a multiple of 16. When a final short block leaves len between 1 and 15, the loop runs once more, reads up to buf[15], and then does "len -= TKS4_MSGBLOCK_SIZE". As len is unsigned this underflows to a huge value. The loop then keeps iterating and walking buf far past the end of the 512-byte ep4_in_buf, reading out of bounds until a bogus block id happens to be hit. Iterate only while a full message block is available. This stops the unsigned underflow and silently drops any trailing partial block, which carries no complete control value anyway. The sibling endpoint-4 parsers are not affected. The Traktor Kontrol X1 and Maschine arms in snd_usb_caiaq_ep4_reply_dispatch() floor urb->actual_length before dispatching.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel ALSA caiaq driver function snd_usb_caiaq_tks4_dispatch() processes input streams from the Traktor Kontrol S4 device in fixed 16-byte blocks. The vulnerability arises because the length of the input data (urb->actual_length) is device-supplied and may not be a multiple of 16. When a final partial block of 1 to 15 bytes is present, the loop incorrectly continues, causing an unsigned underflow of the length variable and reading beyond the allocated 512-byte buffer. This results in an out-of-bounds read until an invalid block ID is encountered. The fix involves iterating only while a full 16-byte block is available, preventing the underflow and ignoring incomplete trailing data. Other related parsers for sibling endpoints are unaffected.
Potential Impact
The vulnerability allows an out-of-bounds read in kernel memory, which could potentially lead to information disclosure or kernel instability. However, no specific exploit or active exploitation in the wild is reported. The impact is limited to the ALSA caiaq driver handling the Traktor Kontrol S4 input stream.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this issue by modifying the input parser to process only complete 16-byte message blocks, preventing the out-of-bounds read. Users should apply the official Linux kernel updates that include this patch. Since this is a kernel-level vulnerability, updating the kernel to a fixed version is the recommended remediation. Patch status is not explicitly stated in the provided data; users should consult the vendor or Linux kernel advisory for the exact fixed versions and update accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-x4v5-hfh7-vrg5
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64487"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a6542069c2644c7f8082371
Added to database: 07/25/2026, 23:08:54 UTC
Last enriched: 07/25/2026, 23:15:58 UTC
Last updated: 09/08/2026, 22:52:14 UTC
Views: 41
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.