CVE-2026-64487

What it actually does

This is an out-of-bounds read in the Linux kernel ALSA snd-usb-caiaq driver while parsing Native Instruments Traktor Kontrol S4 USB input messages. The parser processes endpoint input in fixed 16-byte blocks but previously continued when the device supplied a final partial block of 1–15 bytes. Because the remaining length is unsigned, subtracting 16 from a short length can underflow and cause the parser to walk beyond the 512-byte input buffer. The most likely technical outcome is a kernel fault, KASAN report, or system crash triggered by a malicious or malfunctioning USB device; practical remote exploitation is not expected because attacker control depends on USB device interaction with the vulnerable driver.

Why it matters to the business

Systems that allow untrusted USB peripherals can be crashed or destabilized if a malicious or faulty compatible audio/MIDI controller sends malformed input. The operational risk is highest for Linux workstations, kiosks, production endpoints, recording or performance systems, and shared machines where users can attach USB devices. The vulnerability is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, has low EPSS, and has no public exploit maturity reported, so urgency is generally lower than internet-exposed remote code execution issues; however, organizations with exposed physical USB ports or untrusted peripheral workflows should still patch during the next kernel maintenance cycle.

How an attack unfolds

An attacker needs a way to present a crafted USB device, compromised USB peripheral, or emulated USB device to a vulnerable Linux system using the snd-usb-caiaq driver path for Traktor Kontrol S4 input handling. Once the device is enumerated and the driver processes endpoint-4 input, the attacker sends a URB payload whose actual length is not a multiple of the expected 16-byte message size. The vulnerable parser processes the final incomplete block, reads bytes beyond the valid USB input buffer, underflows the remaining-length counter, and continues reading past the buffer until parsing stops or the kernel faults. In realistic scenarios this is primarily a physical-adjacent denial-of-service condition rather than a network-deliverable attack.

How to fix it

Upgrade to a Linux kernel build that includes the ALSA caiaq fix for snd_usb_caiaq_tks4_dispatch(), which changes parsing to iterate only while a complete 16-byte message block is available and drops trailing partial blocks. If vendor fixed package versions are not yet available, track the Linux distribution’s kernel security advisories and apply the first kernel update that references this ALSA caiaq Traktor Kontrol S4 parser fix. As interim mitigation, restrict untrusted USB device attachment, disable or block the snd-usb-caiaq driver where the affected hardware is not required, use USB device-control policy, and physically protect ports on high-risk endpoints. Disabling the module may affect Native Instruments/ALSA caiaq-compatible devices and should be tested before broad deployment.

How to confirm the fix worked

Confirm exposure by checking whether the running kernel includes the affected snd-usb-caiaq code path and whether the snd_usb_caiaq module is present or loaded. Validate remediation by confirming the system is running a vendor kernel version containing the fix, rebooting into the updated kernel, and verifying the old vulnerable kernel is not the active boot target. Where safe and appropriate in a test environment, use kernel self-testing, KASAN-enabled builds, or controlled USB fuzzing to confirm trailing partial endpoint messages are ignored rather than parsed. Operationally, verify that untrusted USB devices are blocked or that the snd_usb_caiaq module is unavailable on systems that do not need it.

Typical attack path

1. Gain physical access to a Linux system, compromise an already attached USB peripheral, or induce a user to attach an attacker-controlled USB device.
2. Present the device so the Linux ALSA caiaq USB driver binds to it or reaches the Traktor Kontrol S4 input parser path.
3. Send endpoint input where the reported URB actual_length is not divisible by the 16-byte TKS4 message block size.
4. Trigger the parser to process a trailing short block, causing an unsigned length underflow and out-of-bounds reads past the endpoint input buffer.
5. Cause kernel error handling, KASAN/Oops output, driver instability, or a system crash depending on kernel configuration and memory layout.

How to detect it

Review kernel and system logs for signs of snd-usb-caiaq driver faults, USB enumeration of unexpected Native Instruments/Traktor Kontrol S4 devices, and crashes shortly after USB attachment. Useful sources include journald, dmesg, /var/log/kern.log, /var/log/messages, audit logs for module loading, endpoint device-control telemetry, EDR USB device inventory, and kernel crash dumps. Look for KASAN or kernel Oops reports naming snd_usb_caiaq_tks4_dispatch, snd_usb_caiaq_ep4_reply_dispatch, snd_usb_caiaq, caiaq, or endpoint-4 USB input handling. Also investigate repeated USB disconnects/reconnects followed by ALSA driver errors or system reboots. Because exploitation is device-triggered and may leave no durable file artifact, correlation between physical/USB device events and kernel faults is the most useful retrospective signal.

• snd_usb_caiaq_tks4_dispatch
• snd_usb_caiaq_ep4_reply_dispatch
• snd_usb_caiaq
• caiaq
• Traktor Kontrol S4
• KASAN: slab-out-of-bounds
• KASAN: global-out-of-bounds
• BUG: unable to handle page fault
• Oops:
• general protection fault
• usbcore: registered new interface driver snd-usb-caiaq
• /sys/module/snd_usb_caiaq
• /lib/modules/*/kernel/sound/usb/caiaq/snd-usb-caiaq.ko
• snd-usb-caiaq.ko

What your security team should do

• Prioritize patching Linux systems where users can attach USB devices, especially shared workstations, kiosks, media-production endpoints, and systems in semi-public areas.
• Inventory systems with the snd_usb_caiaq module loaded or available and determine whether Native Instruments caiaq-compatible USB audio/MIDI hardware is actually required.
• If the hardware is not required, blocklist or disable the snd_usb_caiaq module as a compensating control until kernel updates are deployed.
• Deploy USB device-control policies that allow only approved vendor/product IDs on endpoints where physical USB exposure is a realistic threat.
• Monitor kernel logs for caiaq driver crashes, KASAN reports, page faults, or repeated USB disconnect/reconnect activity involving Traktor Kontrol S4-class devices.
• Treat unexpected kernel crashes following USB attachment as potentially suspicious and preserve kernel logs, crash dumps, and USB event history for investigation.