PT-2026-64704 · Linux · Linux

CVE-2026-64483

·

Published

2026-07-25

·

Updated

2026-07-25

None

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
ALSA: firewire: isight: bound the sample count to the packet payload
isight packet() takes the frame count from the device iso packet and checks it only against the device claimed iso length.
count = be32 to cpu(payload->sample count);
if (likely(count <= (length - 16) / 4))
	isight samples(isight, payload->samples, count);
length is the iso header data length. It can be up to 0xffff. So the gate allows a count up to about 16379. isight samples() then copies count frames out of payload->samples into the PCM DMA buffer.
payload->samples holds only 2 * MAX FRAMES PER PACKET values. The device multiplexes two samples per frame. A count past MAX FRAMES PER PACKET reads past the payload. A count past the buffer size writes past runtime->dma area. The smallest PCM buffer is larger than MAX FRAMES PER PACKET. Bounding the count to MAX FRAMES PER PACKET keeps both the read and the write in range.
A malicious or faulty Apple iSight on the FireWire bus reaches this during a normal capture.
Add the MAX FRAMES PER PACKET bound to the gate.
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

CVE-2026-64483

Affected Products

Linux