{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64487", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.792Z", "datePublished": "2026-07-25T08:51:46.711Z", "dateUpdated": "2026-07-25T08:51:46.711Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-25T08:51:46.711Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser\n\nsnd_usb_caiaq_tks4_dispatch() decodes the Traktor Kontrol S4 input\nstream in fixed 16-byte (TKS4_MSGBLOCK_SIZE) message blocks. On every\niteration it advances buf and subtracts the block size while looping on\n\"while (len)\".\n\nlen is urb->actual_length. That value is supplied by the device and is\nnot guaranteed to be a multiple of 16. When a final short block leaves\nlen between 1 and 15, the loop runs once more, reads up to buf[15], and\nthen does \"len -= TKS4_MSGBLOCK_SIZE\". As len is unsigned this underflows\nto a huge value. The loop then keeps iterating and walking buf far past\nthe end of the 512-byte ep4_in_buf, reading out of bounds until a bogus\nblock id happens to be hit.\n\nIterate only while a full message block is available. This stops the\nunsigned underflow and silently drops any trailing partial block, which\ncarries no complete control value anyway.\n\nThe sibling endpoint-4 parsers are not affected. The Traktor Kontrol X1\nand Maschine arms in snd_usb_caiaq_ep4_reply_dispatch() floor\nurb->actual_length before dispatching."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/caiaq/input.c"], "versions": [{"version": "15c5ab607045e278ebf4d2ca4aea2250617d50ca", "lessThan": "de5f9edc705497b1b2c6b173b22f283486d2fd91", "status": "affected", "versionType": "git"}, {"version": "15c5ab607045e278ebf4d2ca4aea2250617d50ca", "lessThan": "70d6d4cfa4ad09688aed2ec8a0cfa72c31f60334", "status": "affected", "versionType": "git"}, {"version": "15c5ab607045e278ebf4d2ca4aea2250617d50ca", "lessThan": "884f575cc6acb136eb4a161d925147f85b59c27e", "status": "affected", "versionType": "git"}, {"version": "15c5ab607045e278ebf4d2ca4aea2250617d50ca", "lessThan": "05df59b9a61f7ca66548df079d306c41da23845d", "status": "affected", "versionType": "git"}, {"version": "15c5ab607045e278ebf4d2ca4aea2250617d50ca", "lessThan": "3cad86197c7bf8b45bb1d8adc1099d0913e80469", "status": "affected", "versionType": "git"}, {"version": "15c5ab607045e278ebf4d2ca4aea2250617d50ca", "lessThan": "a5fd3122283bf75c04f6414bf610100beb0565b0", "status": "affected", "versionType": "git"}, {"version": "15c5ab607045e278ebf4d2ca4aea2250617d50ca", "lessThan": "0680413f2f10aab43878dd3db711a6a9e45bab7c", "status": "affected", "versionType": "git"}, {"version": "15c5ab607045e278ebf4d2ca4aea2250617d50ca", "lessThan": "f7f3f9fd81e7adbaa12c2e62ee07f0e094a543fd", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/caiaq/input.c"], "versions": [{"version": "2.6.37", "status": "affected"}, {"version": "0", "lessThan": "2.6.37", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.96", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.39", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.4", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.37", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.37", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.37", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.37", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.37", "versionEndExcluding": "6.12.96"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.37", "versionEndExcluding": "6.18.39"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.37", "versionEndExcluding": "7.1.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.37", "versionEndExcluding": "7.2-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/de5f9edc705497b1b2c6b173b22f283486d2fd91"}, {"url": "https://git.kernel.org/stable/c/70d6d4cfa4ad09688aed2ec8a0cfa72c31f60334"}, {"url": "https://git.kernel.org/stable/c/884f575cc6acb136eb4a161d925147f85b59c27e"}, {"url": "https://git.kernel.org/stable/c/05df59b9a61f7ca66548df079d306c41da23845d"}, {"url": "https://git.kernel.org/stable/c/3cad86197c7bf8b45bb1d8adc1099d0913e80469"}, {"url": "https://git.kernel.org/stable/c/a5fd3122283bf75c04f6414bf610100beb0565b0"}, {"url": "https://git.kernel.org/stable/c/0680413f2f10aab43878dd3db711a6a9e45bab7c"}, {"url": "https://git.kernel.org/stable/c/f7f3f9fd81e7adbaa12c2e62ee07f0e094a543fd"}], "title": "ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/usb/caiaq/input.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "de5f9edc705497b1b2c6b173b22f283486d2fd91", "status": "affected", "version": "15c5ab607045e278ebf4d2ca4aea2250617d50ca", "versionType": "git"}, {"lessThan": "70d6d4cfa4ad09688aed2ec8a0cfa72c31f60334", "status": "affected", "version": "15c5ab607045e278ebf4d2ca4aea2250617d50ca", "versionType": "git"}, {"lessThan": "884f575cc6acb136eb4a161d925147f85b59c27e", "status": "affected", "version": "15c5ab607045e278ebf4d2ca4aea2250617d50ca", "versionType": "git"}, {"lessThan": "05df59b9a61f7ca66548df079d306c41da23845d", "status": "affected", "version": "15c5ab607045e278ebf4d2ca4aea2250617d50ca", "versionType": "git"}, {"lessThan": "3cad86197c7bf8b45bb1d8adc1099d0913e80469", "status": "affected", "version": "15c5ab607045e278ebf4d2ca4aea2250617d50ca", "versionType": "git"}, {"lessThan": "a5fd3122283bf75c04f6414bf610100beb0565b0", "status": "affected", "version": "15c5ab607045e278ebf4d2ca4aea2250617d50ca", "versionType": "git"}, {"lessThan": "0680413f2f10aab43878dd3db711a6a9e45bab7c", "status": "affected", "version": "15c5ab607045e278ebf4d2ca4aea2250617d50ca", "versionType": "git"}, {"lessThan": "f7f3f9fd81e7adbaa12c2e62ee07f0e094a543fd", "status": "affected", "version": "15c5ab607045e278ebf4d2ca4aea2250617d50ca", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/usb/caiaq/input.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.37"}, {"lessThan": "2.6.37", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.261", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.96", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.39", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser\n\nsnd_usb_caiaq_tks4_dispatch() decodes the Traktor Kontrol S4 input\nstream in fixed 16-byte (TKS4_MSGBLOCK_SIZE) message blocks. On every\niteration it advances buf and subtracts the block size while looping on\n\"while (len)\".\n\nlen is urb->actual_length. That value is supplied by the device and is\nnot guaranteed to be a multiple of 16. When a final short block leaves\nlen between 1 and 15, the loop runs once more, reads up to buf[15], and\nthen does \"len -= TKS4_MSGBLOCK_SIZE\". As len is unsigned this underflows\nto a huge value. The loop then keeps iterating and walking buf far past\nthe end of the 512-byte ep4_in_buf, reading out of bounds until a bogus\nblock id happens to be hit.\n\nIterate only while a full message block is available. This stops the\nunsigned underflow and silently drops any trailing partial block, which\ncarries no complete control value anyway.\n\nThe sibling endpoint-4 parsers are not affected. The Traktor Kontrol X1\nand Maschine arms in snd_usb_caiaq_ep4_reply_dispatch() floor\nurb->actual_length before dispatching."}], "id": "CVE-2026-64487", "lastModified": "2026-07-25T10:17:34.423", "metrics": {}, "published": "2026-07-25T10:17:34.423", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/05df59b9a61f7ca66548df079d306c41da23845d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0680413f2f10aab43878dd3db711a6a9e45bab7c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3cad86197c7bf8b45bb1d8adc1099d0913e80469"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/70d6d4cfa4ad09688aed2ec8a0cfa72c31f60334"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/884f575cc6acb136eb4a161d925147f85b59c27e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a5fd3122283bf75c04f6414bf610100beb0565b0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/de5f9edc705497b1b2c6b173b22f283486d2fd91"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f7f3f9fd81e7adbaa12c2e62ee07f0e094a543fd"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser", "id": "2507086", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507086"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in the Linux kernel's sound subsystem, specifically within the ALSA caiaq driver responsible for handling Traktor Kontrol S4 devices. A local attacker, by providing specially crafted input from a connected device, could exploit an out-of-bounds read vulnerability. This issue arises from incorrect handling of input stream lengths, leading to the system reading beyond its allocated memory buffer. Successful exploitation could result in the disclosure of sensitive information from kernel memory or cause a system crash, leading to a denial of service."], "name": "CVE-2026-64487", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64487\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64487\nhttps://lore.kernel.org/linux-cve-announce/2026072549-CVE-2026-64487-03f3@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15c5ab607045e278ebf4d2ca4aea2250617d50ca,de5f9edc705497b1b2c6b173b22f283486d2fd91)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15c5ab607045e278ebf4d2ca4aea2250617d50ca,70d6d4cfa4ad09688aed2ec8a0cfa72c31f60334)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15c5ab607045e278ebf4d2ca4aea2250617d50ca,884f575cc6acb136eb4a161d925147f85b59c27e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15c5ab607045e278ebf4d2ca4aea2250617d50ca,05df59b9a61f7ca66548df079d306c41da23845d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15c5ab607045e278ebf4d2ca4aea2250617d50ca,3cad86197c7bf8b45bb1d8adc1099d0913e80469)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15c5ab607045e278ebf4d2ca4aea2250617d50ca,a5fd3122283bf75c04f6414bf610100beb0565b0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15c5ab607045e278ebf4d2ca4aea2250617d50ca,0680413f2f10aab43878dd3db711a6a9e45bab7c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15c5ab607045e278ebf4d2ca4aea2250617d50ca,f7f3f9fd81e7adbaa12c2e62ee07f0e094a543fd)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.37"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.37)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.261,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.212,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.178,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.96,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.39,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.4,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-25T20:45:02.439195+00:00", "updated": "2026-08-02T12:30:05.800992+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}