This bug occurs in the Linux kernel ALSA driver caiaq when parsing input streams from a Traktor Kontrol S4 device. The dispatcher reads data in fixed 16‑byte blocks but uses the device supplied length value without ensuring that the length is a multiple of the block size. When a final partial block arrives, the loop iterates once more, reads past the end of the 512‑byte endpoint buffer, and then underflows the unsigned length counter. The result is an out‑of‑bounds read that can expose kernel data to the connected USB device. An attacker who can provide a malicious USB device that mimics a Traktor Kontrol S4 is able to trigger the vulnerability, causing the kernel to read beyond the intended buffer. If exploited, sensitive kernel memory can be leaked to the device, potentially leaking secrets or facilitating further attacks. Given the nature of the flaw, exploitation requires local access to the hardware bus, and the vulnerability is not publicly listed in the CISA KEV catalog. The EPSS score of less than 1% indicates a low probability of exploitation, but the missing bounds check makes it a legitimate local information‑disclosure risk.

The flaw affects the ALSA USB caiaq driver in the Linux kernel. All kernel releases that include the snd_usb_caiaq_tks4_dispatch implementation before the fix are vulnerable. The issue is resolved in later kernel versions containing the patch referenced in the provided source commits.

The CVSS score of 5.5 indicates medium severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA KEV. Attackers need local USB device access and sufficient privilege to load the driver; the flaw does not permit remote execution but can leak kernel data. Administrators should treat it as a local information‑disclosure concern and apply the patch as soon as possible.