CVE-2026-64483

What it actually does

This is a Linux kernel memory-safety flaw in the ALSA FireWire Apple iSight audio driver. During normal audio capture, the driver trusts the sample count reported in an isochronous FireWire packet and bounds it only against the packet’s declared length, not against the driver’s maximum frames-per-packet limit or the actual backing buffers. A malicious or malfunctioning iSight-compatible FireWire device can provide an oversized sample count, causing the kernel driver to read beyond the packet sample array and potentially write beyond the PCM DMA buffer. The likely outcomes are kernel memory corruption, kernel crash, denial of service, and, in less common but higher-impact scenarios, possible kernel-level code execution depending on platform hardening, memory layout, and exploit reliability.

Why it matters to the business

Systems that use vulnerable Linux kernels with the Apple iSight FireWire audio driver exposed to untrusted or faulty FireWire devices may be crashed or destabilized simply by starting capture from a malicious device. The practical exposure is narrower than most remotely exploitable vulnerabilities because exploitation requires physical access, a connected malicious FireWire/iSight-compatible device, or compromise of a device on the FireWire bus. However, affected workstations, media capture systems, kiosks, labs, forensic stations, and legacy Apple/FireWire environments could experience outages, data loss from crashes, or potential full system compromise if kernel memory corruption is weaponized. The CVE is not currently listed in CISA KEV, is not marked as used in ransomware campaigns, has very low EPSS, and has no reported public exploit maturity in the supplied data, so prioritization should be highest for systems where FireWire peripherals are allowed or physically accessible.

How an attack unfolds

An attacker first needs a way to place a malicious or malformed Apple iSight-compatible device on the victim’s FireWire bus, or otherwise control a faulty/compromised FireWire device that the vulnerable driver will bind to. When the user or system initiates normal audio capture, the device sends an isochronous packet with a crafted sample_count value. The vulnerable kernel path accepts the value because it is checked against the packet’s declared data length, which can be much larger than the driver’s fixed per-packet sample storage. The driver then passes the excessive count into the sample handling routine, which copies more frames than the packet sample array and PCM DMA buffer can safely support. This can trigger an out-of-bounds read, an out-of-bounds write, kernel oops, panic, or memory corruption. A reliable exploit would need to shape the corrupted kernel memory and bypass kernel mitigations; absent that, the most realistic exploitation outcome is a local/physical denial of service through a kernel crash.

How to fix it

Apply the Linux kernel update that includes the ALSA FireWire iSight fix bounding the sample count to MAX_FRAMES_PER_PACKET. Because no exact fixed package versions were provided, use the relevant Linux distribution kernel advisories and upgrade to the first vendor-supported kernel release containing the fix for CVE-2026-64483. Where immediate patching is not possible, reduce exposure by disabling FireWire support on systems that do not require it, unloading or blacklisting the Apple iSight FireWire audio driver, blocking use of untrusted FireWire peripherals, and enforcing physical port controls for FireWire-capable systems. Practical mitigations include removing legacy FireWire hardware where possible, disabling FireWire in firmware/BIOS if supported, preventing automatic loading of the affected sound driver, and restricting media capture workflows to trusted devices only.

How to confirm the fix worked

Confirm that systems are running a kernel build from the distribution or vendor that includes the ALSA FireWire iSight sample-count bounds check. Validate package state with the OS package manager and compare the installed kernel version against vendor security advisories for this CVE. On representative systems, check whether FireWire support and the iSight audio driver are present or loaded using module and device enumeration tools such as lsmod, modinfo, lspci, dmesg, and /sys/bus/firewire. If mitigating rather than patching, verify that the affected module cannot be loaded, that no Apple iSight FireWire device binds to the driver, and that FireWire ports are disabled or physically controlled. For engineering validation, review the kernel source or vendor patch metadata for the added MAX_FRAMES_PER_PACKET bound in the isight_packet() path.

Typical attack path

1. Identify a Linux system with FireWire support and the ALSA Apple iSight FireWire audio driver available or loaded.
2. Gain physical access to the system, convince a user to connect a malicious FireWire/iSight-compatible device, or compromise a device already on the FireWire bus.
3. Ensure the vulnerable driver binds to the device and audio capture is started through normal system or user activity.
4. Send crafted isochronous FireWire packets with a sample count larger than the driver’s maximum frames-per-packet limit.
5. Trigger the vulnerable copy path in the kernel driver, causing out-of-bounds memory access.
6. Use the resulting memory corruption to crash the system or, if exploit development is successful, attempt kernel-level code execution.

How to detect it

Retrospective detection should focus on evidence of vulnerable driver exposure combined with kernel faults during FireWire/iSight audio capture. Review kernel logs, persistent journal entries, crash dumps, and monitoring telemetry for oops, panic, KASAN, UBSAN, page fault, general protection fault, or DMA/memory corruption messages that reference the Apple iSight FireWire ALSA driver, isight_packet(), isight_samples(), snd-isight, snd_isight, or FireWire audio capture activity. Check device-connection histories where available for unexpected FireWire peripherals, Apple iSight devices, or FireWire bus resets shortly before a crash. Review shell, udev, audit, and endpoint telemetry for manual loading of FireWire or iSight sound modules on systems that normally do not use them. Absence of a clear log message does not prove non-exploitation because successful kernel memory corruption may produce only a crash or no durable artifact; prioritize correlating device attachment, capture start events, and kernel fault timing.

• snd-isight
• snd_isight
• /sys/module/snd_isight
• /sys/bus/firewire/drivers/snd-isight
• sound/firewire/isight.c
• isight_packet
• isight_samples
• Apple iSight
• ALSA: firewire
• BUG: unable to handle kernel paging request
• general protection fault
• kernel panic
• KASAN: slab-out-of-bounds
• KASAN: out-of-bounds
• firewire_ohci
• firewire-ohci

What your security team should do

• Inventory Linux systems with FireWire hardware, Apple iSight/FireWire capture workflows, or the snd-isight/snd_isight driver present.
• Prioritize patching on physically accessible workstations, media capture stations, lab systems, kiosks, forensic workstations, and any systems where untrusted peripherals may be connected.
• Upgrade to a vendor-supported kernel release that includes the ALSA FireWire iSight bounds-check fix.
• Where FireWire/iSight support is unnecessary, disable FireWire and blacklist the affected driver to remove the attack surface.
• Add monitoring for kernel oops, panic, KASAN, or general protection fault events referencing the iSight FireWire audio driver or ALSA FireWire capture paths.
• Treat unexpected crashes occurring during FireWire/iSight audio capture as potentially security-relevant and preserve kernel logs for analysis.
• Restrict physical access and peripheral attachment rights for systems that must retain FireWire support.
• Because there is no KEV listing, no ransomware association, very low EPSS, and no supplied public exploit maturity, track through normal kernel patch cycles unless the organization has meaningful FireWire exposure.