« Volver al listado

CVE-2026-64483

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

ALSA: firewire: isight: bound the sample count to the packet payload

isight_packet() takes the frame count from the device iso packet and checks it only against the device claimed iso length.

length is the iso header data_length. It can be up to 0xffff. So the gate allows a count up to about 16379. isight_samples() then copies count frames out of payload->samples into the PCM DMA buffer.

payload->samples holds only 2 * MAX_FRAMES_PER_PACKET values. The device multiplexes two samples per frame. A count past MAX_FRAMES_PER_PACKET reads past the payload.

Leer descripción completaMostrar menos

A count past the buffer size writes past runtime->dma_area. The smallest PCM buffer is larger than MAX_FRAMES_PER_PACKET. Bounding the count to MAX_FRAMES_PER_PACKET keeps both the read and the write in range.

A malicious or faulty Apple iSight on the FireWire bus reaches this during a normal capture.

Add the MAX_FRAMES_PER_PACKET bound to the gate.

Detalles técnicos trazas, registros y código del informe original
	count = be32_to_cpu(payload->sample_count);
	if (likely(count <= (length - 16) / 4))
		isight_samples(isight, payload->samples, count);

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-64483",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3a691b28a0ca3cf4d9010c6158318159e0275d2c",
              "lessThan": "24423e0a9251d348c3f1fb0bb0e61b879e1e976c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3a691b28a0ca3cf4d9010c6158318159e0275d2c",
              "lessThan": "ebbffacda6733dcbcef601b5b523460f8d8b671e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3a691b28a0ca3cf4d9010c6158318159e0275d2c",
              "lessThan": "57e4d9043afc1eaddee8f50d11def6e65415d273",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3a691b28a0ca3cf4d9010c6158318159e0275d2c",
              "lessThan": "3ed2fa1ed8cc65f910b8bbc0be3cc366b30f8478",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3a691b28a0ca3cf4d9010c6158318159e0275d2c",
              "lessThan": "31da82b9676c6b112e7c72c7529e6812b919742a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3a691b28a0ca3cf4d9010c6158318159e0275d2c",
              "lessThan": "8e48a29813df8dd71503800b7acf69c12c035045",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3a691b28a0ca3cf4d9010c6158318159e0275d2c",
              "lessThan": "31a01b70bb90e3ef3147f308e2ea899e1d2485ca",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3a691b28a0ca3cf4d9010c6158318159e0275d2c",
              "lessThan": "29b9667982e4df2ed7744f86b1144f8bb58eb698",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "sound/firewire/isight.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.0"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "3.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "sound/firewire/isight.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-07-25T10:17:33.957",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/24423e0a9251d348c3f1fb0bb0e61b879e1e976c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/29b9667982e4df2ed7744f86b1144f8bb58eb698",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/31a01b70bb90e3ef3147f308e2ea899e1d2485ca",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/31da82b9676c6b112e7c72c7529e6812b919742a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3ed2fa1ed8cc65f910b8bbc0be3cc366b30f8478",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/57e4d9043afc1eaddee8f50d11def6e65415d273",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8e48a29813df8dd71503800b7acf69c12c035045",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ebbffacda6733dcbcef601b5b523460f8d8b671e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: firewire: isight: bound the sample count to the packet payload\n\nisight_packet() takes the frame count from the device iso packet and\nchecks it only against the device claimed iso length.\n\n\tcount = be32_to_cpu(payload->sample_count);\n\tif (likely(count <= (length - 16) / 4))\n\t\tisight_samples(isight, payload->samples, count);\n\nlength is the iso header data_length. It can be up to 0xffff. So the\ngate allows a count up to about 16379. isight_samples() then copies\ncount frames out of payload->samples into the PCM DMA buffer.\n\npayload->samples holds only 2 * MAX_FRAMES_PER_PACKET values. The\ndevice multiplexes two samples per frame. A count past\nMAX_FRAMES_PER_PACKET reads past the payload. A count past the buffer\nsize writes past runtime->dma_area. The smallest PCM buffer is larger\nthan MAX_FRAMES_PER_PACKET. Bounding the count to MAX_FRAMES_PER_PACKET\nkeeps both the read and the write in range.\n\nA malicious or faulty Apple iSight on the FireWire bus reaches this\nduring a normal capture.\n\nAdd the MAX_FRAMES_PER_PACKET bound to the gate."
    }
  ],
  "lastModified": "2026-08-17T05:17:54.097",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}