Out-of-bounds read in Linux kernel - CVE-2026-64487
Published: July 27, 2026
Vulnerability identifier: #VU139448
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64487
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker with physical access to cause a denial of service.
The vulnerability exists due to out-of-bounds read in snd_usb_caiaq_tks4_dispatch() when parsing input from a crafted USB device input stream. An attacker with physical access can provide a malformed short final message block to cause a denial of service.
The issue is triggered because the device-controlled input length is not guaranteed to be a multiple of the 16-byte message block size, leading to an unsigned underflow during iteration.
Affected software
Linux kernel
How to mitigate CVE-2026-64487
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/05df59b9a61f7ca66548df079d306c41da23845d
- https://git.kernel.org/stable/c/0680413f2f10aab43878dd3db711a6a9e45bab7c
- https://git.kernel.org/stable/c/3cad86197c7bf8b45bb1d8adc1099d0913e80469
- https://git.kernel.org/stable/c/70d6d4cfa4ad09688aed2ec8a0cfa72c31f60334
- https://git.kernel.org/stable/c/884f575cc6acb136eb4a161d925147f85b59c27e
- https://git.kernel.org/stable/c/a5fd3122283bf75c04f6414bf610100beb0565b0
- https://git.kernel.org/stable/c/de5f9edc705497b1b2c6b173b22f283486d2fd91
- https://git.kernel.org/stable/c/f7f3f9fd81e7adbaa12c2e62ee07f0e094a543fd