Task Creation Issue in Linux Kernel ALSA Driver

CVE-2026-64485

What is CVE-2026-64485?

A vulnerability within the Linux kernel's ALSA subsystem has been identified related to improper handling of task creation and DMA buffer validation. Specifically, when the function snd_compr_task_new() creates a new driver task, it does so without validating the returned DMA buffers and reserving file descriptors. This oversight can lead to resource leaks, as the system may free task wrappers and DMA buffer references without invoking the necessary driver's task_free() callback upon subsequent errors. Furthermore, failure to store the result from get_unused_fd_flags() can cause the system to incorrectly report a successful task creation, even if the task was ultimately discarded. Addressing these errors is crucial to ensure efficient resource management and prevent potential leaks.

References