ALSA Vulnerability in Linux Kernel Affecting Traktor Kontrol S4 by Native Instruments

CVE-2026-64487

What is CVE-2026-64487?

An out-of-bounds read vulnerability in the ALSA subsystem of the Linux kernel affects the Traktor Kontrol S4 input parser. This issue arises when the snd_usb_caiaq_tks4_dispatch function processes input stream messages. Due to an improper handling of the length value, the process can lead to excessive memory access beyond the intended buffer boundaries, posing risks of data corruption or system instability. The issue has been rectified by refining the iteration logic to handle only full message blocks, eliminating the potential for unsigned underflow that could exploit memory boundaries.

References