---
id: CVE-2026-64487
title: 'ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser

  snd_usb_caiaq_tks4_dispatch() decodes the Traktor Kontrol S4 input
  stream in fixed 16-byte (…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 15c5ab607045e278ebf4d2ca4aea2250617d50ca <
    de5f9edc705497b1b2c6b173b22f283486d2fd91
  - >-
    Linux >= 15c5ab607045e278ebf4d2ca4aea2250617d50ca <
    70d6d4cfa4ad09688aed2ec8a0cfa72c31f60334
  - >-
    Linux >= 15c5ab607045e278ebf4d2ca4aea2250617d50ca <
    884f575cc6acb136eb4a161d925147f85b59c27e
  - >-
    Linux >= 15c5ab607045e278ebf4d2ca4aea2250617d50ca <
    05df59b9a61f7ca66548df079d306c41da23845d
  - >-
    Linux >= 15c5ab607045e278ebf4d2ca4aea2250617d50ca <
    3cad86197c7bf8b45bb1d8adc1099d0913e80469
  - >-
    Linux >= 15c5ab607045e278ebf4d2ca4aea2250617d50ca <
    a5fd3122283bf75c04f6414bf610100beb0565b0
  - >-
    Linux >= 15c5ab607045e278ebf4d2ca4aea2250617d50ca <
    0680413f2f10aab43878dd3db711a6a9e45bab7c
  - >-
    Linux >= 15c5ab607045e278ebf4d2ca4aea2250617d50ca <
    f7f3f9fd81e7adbaa12c2e62ee07f0e094a543fd
  - Linux 2.6.37
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:40:21.910578Z'
published: '2026-07-25'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:44:55.344Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64487'
references:
  - url: 'https://git.kernel.org/stable/c/de5f9edc705497b1b2c6b173b22f283486d2fd91'
  - url: 'https://git.kernel.org/stable/c/70d6d4cfa4ad09688aed2ec8a0cfa72c31f60334'
  - url: 'https://git.kernel.org/stable/c/884f575cc6acb136eb4a161d925147f85b59c27e'
  - url: 'https://git.kernel.org/stable/c/05df59b9a61f7ca66548df079d306c41da23845d'
  - url: 'https://git.kernel.org/stable/c/3cad86197c7bf8b45bb1d8adc1099d0913e80469'
  - url: 'https://git.kernel.org/stable/c/a5fd3122283bf75c04f6414bf610100beb0565b0'
  - url: 'https://git.kernel.org/stable/c/0680413f2f10aab43878dd3db711a6a9e45bab7c'
  - url: 'https://git.kernel.org/stable/c/f7f3f9fd81e7adbaa12c2e62ee07f0e094a543fd'
tags:
  - cve.org
epss: 0.00184
epssPercentile: 0.08082
ingestedAt: '2026-11-06T16:57:43.162Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser

snd_usb_caiaq_tks4_dispatch() decodes the Traktor Kontrol S4 input
stream in fixed 16-byte (TKS4_MSGBLOCK_SIZE) message blocks. On every
iteration it advances buf and subtracts the block size while looping on
"while (len)".

len is urb->actual_length. That value is supplied by the device and is
not guaranteed to be a multiple of 16. When a final short block leaves
len between 1 and 15, the loop runs once more, reads up to buf[15], and
then does "len -= TKS4_MSGBLOCK_SIZE". As len is unsigned this underflows
to a huge value. The loop then keeps iterating and walking buf far past
the end of the 512-byte ep4_in_buf, reading out of bounds until a bogus
block id happens to be hit.

Iterate only while a full message block is available. This stops the
unsigned underflow and silently drops any trailing partial block, which
carries no complete control value anyway.

The sibling endpoint-4 parsers are not affected. The Traktor Kontrol X1
and Maschine arms in snd_usb_caiaq_ep4_reply_dispatch() floor
urb->actual_length before dispatching.

## Affected

- `Linux >= 15c5ab607045e278ebf4d2ca4aea2250617d50ca < de5f9edc705497b1b2c6b173b22f283486d2fd91`
- `Linux >= 15c5ab607045e278ebf4d2ca4aea2250617d50ca < 70d6d4cfa4ad09688aed2ec8a0cfa72c31f60334`
- `Linux >= 15c5ab607045e278ebf4d2ca4aea2250617d50ca < 884f575cc6acb136eb4a161d925147f85b59c27e`
- `Linux >= 15c5ab607045e278ebf4d2ca4aea2250617d50ca < 05df59b9a61f7ca66548df079d306c41da23845d`
- `Linux >= 15c5ab607045e278ebf4d2ca4aea2250617d50ca < 3cad86197c7bf8b45bb1d8adc1099d0913e80469`
- `Linux >= 15c5ab607045e278ebf4d2ca4aea2250617d50ca < a5fd3122283bf75c04f6414bf610100beb0565b0`
- `Linux >= 15c5ab607045e278ebf4d2ca4aea2250617d50ca < 0680413f2f10aab43878dd3db711a6a9e45bab7c`
- `Linux >= 15c5ab607045e278ebf4d2ca4aea2250617d50ca < f7f3f9fd81e7adbaa12c2e62ee07f0e094a543fd`
- `Linux 2.6.37`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.