CVE-2026-64485

Received Received - Intake

Memory Leak in Linux Kernel ALSA Compress Driver

Publication date: 2026-07-25

Last updated on: 2026-07-27

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: compress: Fix task creation error unwind snd_compr_task_new() allocates the driver task before validating the returned DMA buffers and reserving file descriptors. When either of those later steps fails, the core frees its task wrapper and DMA-buffer references without calling the driver's task_free() callback. Any driver resources allocated by task_create() are therefore leaked. The dual-fd allocation path also jumps to cleanup without storing the negative get_unused_fd_flags() result in retval. Since retval still contains the successful task_create() return value, TASK_CREATE can incorrectly report success although the task was discarded. Preserve the fd allocation errors and call task_free() when failure occurs after a successful task_create() callback.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-07-27

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64485

EUVD

EUVD-2026-48829

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the ALSA compress driver's task creation process. The function snd_compr_task_new allocates a driver task before validating DMA buffers and reserving file descriptors. If either validation or reservation fails, the core frees resources without calling the driver's task_free callback, causing resource leaks. Additionally, a dual-fd allocation path incorrectly reports success even when task creation fails.

Detection Guidance

This vulnerability is specific to the Linux kernel's ALSA compress subsystem and does not have a direct network detection method. To check for affected systems, verify the kernel version and whether the vulnerable code path exists. Use commands like 'uname -a' to check the kernel version and inspect kernel logs for ALSA compress errors.

Impact Analysis

This vulnerability could lead to resource leaks in the Linux kernel's ALSA compress subsystem. If exploited, it may cause system instability or denial of service by exhausting kernel resources. Systems relying on audio compression features could experience crashes or unexpected behavior.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards. It involves a memory/resource leak in the Linux kernel's ALSA compress subsystem due to improper error handling during task creation. No evidence suggests it affects data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch the vulnerability. If an update is not immediately available, consider disabling the ALSA compress subsystem if not required, or restrict access to audio devices to trusted users.

Hi! I’m here to help you understand CVE-2026-64485. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70