Executive brief
A vulnerability in the Linux kernel's audio driver for Traktor Kontrol S4 DJ controllers could allow a malicious or malfunctioning USB device to crash the system. The driver fails to properly validate the size of incoming data packets, leading to an out-of-bounds memory read. This could result in a system crash (denial of service) or potentially expose sensitive information from the computer's memory when the device is plugged in.
Technical details
An out-of-bounds read exists in the snd_usb_caiaq_tks4_dispatch() function within sound/usb/caiaq/input.c. The parser decodes input streams in fixed 16-byte blocks but fails to verify that the remaining length (urb->actual_length) is at least 16 bytes before processing. If a device sends a short block (1-15 bytes), an unsigned integer underflow occurs when subtracting the block size from the length, causing the loop to continue indefinitely and read past the allocated 512-byte buffer. This can lead to a kernel oops or information disclosure. The issue has been patched by ensuring the loop only iterates while a full 16-byte block is available.
Affected products
- Linux Linux Kernel 15c5ab607045 to de5f9edc7054, 70d6d4cfa4ad, 884f575cc6ac, 05df59b9a61f, 3cad86197c7b, a5fd3122283b, f7f3f9fd81e7
Timeline
- 2026-06-18: other: Vulnerability fixed in kernel source
- 2026-07-24: patched: Patches committed to stable branches
- 2026-07-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/05df59b9a61f7ca66548df079d306c41da23845d
- https://git.kernel.org/stable/c/0680413f2f10aab43878dd3db711a6a9e45bab7c
- https://git.kernel.org/stable/c/3cad86197c7bf8b45bb1d8adc1099d0913e80469
- https://git.kernel.org/stable/c/70d6d4cfa4ad09688aed2ec8a0cfa72c31f60334
- https://git.kernel.org/stable/c/884f575cc6acb136eb4a161d925147f85b59c27e
- https://git.kernel.org/stable/c/a5fd3122283bf75c04f6414bf610100beb0565b0
- https://git.kernel.org/stable/c/de5f9edc705497b1b2c6b173b22f283486d2fd91