CVE-2026-64483

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: firewire: isight: bound the sample count to the packet payload<br /> <br /> isight_packet() takes the frame count from the device iso packet and<br /> checks it only against the device claimed iso length.<br /> <br /> count = be32_to_cpu(payload-&gt;sample_count);<br /> if (likely(count samples, count);<br /> <br /> length is the iso header data_length. It can be up to 0xffff. So the<br /> gate allows a count up to about 16379. isight_samples() then copies<br /> count frames out of payload-&gt;samples into the PCM DMA buffer.<br /> <br /> payload-&gt;samples holds only 2 * MAX_FRAMES_PER_PACKET values. The<br /> device multiplexes two samples per frame. A count past<br /> MAX_FRAMES_PER_PACKET reads past the payload. A count past the buffer<br /> size writes past runtime-&gt;dma_area. The smallest PCM buffer is larger<br /> than MAX_FRAMES_PER_PACKET. Bounding the count to MAX_FRAMES_PER_PACKET<br /> keeps both the read and the write in range.<br /> <br /> A malicious or faulty Apple iSight on the FireWire bus reaches this<br /> during a normal capture.<br /> <br /> Add the MAX_FRAMES_PER_PACKET bound to the gate.