CVE-2026-64483: ALSA: firewire: isight: bound the sample count to the packet payload

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ALSA: firewire: isight: bound the sample count to the packet payload

isight_packet() takes the frame count from the device iso packet and
checks it only against the device claimed iso length.

	count = be32_to_cpu(payload->sample_count);
	if (likely(count <= (length - 16) / 4))
		isight_samples(isight, payload->samples, count);

length is the iso header data_length. It can be up to 0xffff. So the
gate allows a count up to about 16379. isight_samples() then copies
count frames out of payload->samples into the PCM DMA buffer.

payload->samples holds only 2 * MAX_FRAMES_PER_PACKET values. The
device multiplexes two samples per frame. A count past
MAX_FRAMES_PER_PACKET reads past the payload. A count past the buffer
size writes past runtime->dma_area. The smallest PCM buffer is larger
than MAX_FRAMES_PER_PACKET. Bounding the count to MAX_FRAMES_PER_PACKET
keeps both the read and the write in range.

A malicious or faulty Apple iSight on the FireWire bus reaches this
during a normal capture.

Add the MAX_FRAMES_PER_PACKET bound to the gate.

The Linux kernel CVE team has assigned CVE-2026-64483 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.0 with commit 3a691b28a0ca3cf4d9010c6158318159e0275d2c and fixed in 5.10.261 with commit 24423e0a9251d348c3f1fb0bb0e61b879e1e976c
	Issue introduced in 3.0 with commit 3a691b28a0ca3cf4d9010c6158318159e0275d2c and fixed in 5.15.212 with commit ebbffacda6733dcbcef601b5b523460f8d8b671e
	Issue introduced in 3.0 with commit 3a691b28a0ca3cf4d9010c6158318159e0275d2c and fixed in 6.1.178 with commit 57e4d9043afc1eaddee8f50d11def6e65415d273
	Issue introduced in 3.0 with commit 3a691b28a0ca3cf4d9010c6158318159e0275d2c and fixed in 6.6.145 with commit 3ed2fa1ed8cc65f910b8bbc0be3cc366b30f8478
	Issue introduced in 3.0 with commit 3a691b28a0ca3cf4d9010c6158318159e0275d2c and fixed in 6.12.96 with commit 31da82b9676c6b112e7c72c7529e6812b919742a
	Issue introduced in 3.0 with commit 3a691b28a0ca3cf4d9010c6158318159e0275d2c and fixed in 6.18.39 with commit 8e48a29813df8dd71503800b7acf69c12c035045
	Issue introduced in 3.0 with commit 3a691b28a0ca3cf4d9010c6158318159e0275d2c and fixed in 7.1.4 with commit 31a01b70bb90e3ef3147f308e2ea899e1d2485ca
	Issue introduced in 3.0 with commit 3a691b28a0ca3cf4d9010c6158318159e0275d2c and fixed in 7.2-rc1 with commit 29b9667982e4df2ed7744f86b1144f8bb58eb698

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64483
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	sound/firewire/isight.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/24423e0a9251d348c3f1fb0bb0e61b879e1e976c
	https://git.kernel.org/stable/c/ebbffacda6733dcbcef601b5b523460f8d8b671e
	https://git.kernel.org/stable/c/57e4d9043afc1eaddee8f50d11def6e65415d273
	https://git.kernel.org/stable/c/3ed2fa1ed8cc65f910b8bbc0be3cc366b30f8478
	https://git.kernel.org/stable/c/31da82b9676c6b112e7c72c7529e6812b919742a
	https://git.kernel.org/stable/c/8e48a29813df8dd71503800b7acf69c12c035045
	https://git.kernel.org/stable/c/31a01b70bb90e3ef3147f308e2ea899e1d2485ca
	https://git.kernel.org/stable/c/29b9667982e4df2ed7744f86b1144f8bb58eb698