CVE-2026-64487 ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
A malicious USB device can trigger an integer underflow in the ALSA caiaq driver, causing an out-of-bounds read and potential system crash or data leak.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64487?
CVE-2026-64487 is a vulnerability in Linux, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
snd_usb_caiaq_tks4_dispatch() decodes the Traktor Kontrol S4 input stream in fixed 16-byte (TKS4_MSGBLOCK_SIZE) message blocks. On every iteration it advances buf and subtracts the block size while looping on "while (len)".
len is urb->actual_length. That value is supplied by the device and is not guaranteed to be a multiple of 16. When a final short block leaves len between 1 and 15, the loop runs once more, reads up to buf[15], and then does "len -= TKS4_MSGBLOCK_SIZE". As len is unsigned this underflows to a huge value. The loop then keeps iterating and walking buf far past the end of the 512-byte ep4_in_buf, reading out of bounds until a bogus block id happens to be hit.
Iterate only while a full message block is available. This stops the unsigned underflow and silently drops any trailing partial block, which carries no complete control value anyway.
The sibling endpoint-4 parsers are not affected. The Traktor Kontrol X1 and Maschine arms in snd_usb_caiaq_ep4_reply_dispatch() floor urb->actual_length before dispatching.
Which versions are affected by CVE-2026-64487?
How do I fix CVE-2026-64487?
Apply the vendor's patch.
Is CVE-2026-64487 being exploited?
There is no known exploitation of CVE-2026-64487 in the wild and no public exploit code.
Sources
Also known as AZL-93533, BELL-CVE-2026-64487, DEBIAN-CVE-2026-64487, GHSA-x4v5-hfh7-vrg5, ROOT-OS-UBUNTU-2204-CVE-2026-64487, UBUNTU-CVE-2026-64487.