{"id":"CVE-2026-64485","title":"ALSA: compress: Fix task creation error unwind","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: compress: Fix task creation error unwind\n\nsnd_compr_task_new() allocates the driver task before validating the\nreturned DMA buffers and reserving file descriptors…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 04177158cf98a79744937893b100020d77e6f9ac < b27a75d42044d9d4709095617730b91b1c4af423","Linux >= 04177158cf98a79744937893b100020d77e6f9ac < 426a9947a38d272d0e19c031658da68e31128667","Linux >= 04177158cf98a79744937893b100020d77e6f9ac < 4a60127debb9e370d6c0e22a307326b624a141f3","Linux 6.13"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:41:21.913434Z"},"published":"2026-07-25","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:42:38.298Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64485","references":[{"url":"https://git.kernel.org/stable/c/b27a75d42044d9d4709095617730b91b1c4af423"},{"url":"https://git.kernel.org/stable/c/426a9947a38d272d0e19c031658da68e31128667"},{"url":"https://git.kernel.org/stable/c/4a60127debb9e370d6c0e22a307326b624a141f3"}],"tags":["cve.org"],"epss":0.00173,"epssPercentile":0.06329,"ingestedAt":"2026-10-16T17:24:46.823Z","slug":"CVE-2026-64485","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nALSA: compress: Fix task creation error unwind\n\nsnd_compr_task_new() allocates the driver task before validating the\nreturned DMA buffers and reserving file descriptors. When either of\nthose later steps fails, the core frees its task wrapper and DMA-buffer\nreferences without calling the driver's task_free() callback. Any\ndriver resources allocated by task_create() are therefore leaked.\n\nThe dual-fd allocation path also jumps to cleanup without storing the\nnegative get_unused_fd_flags() result in retval. Since retval still\ncontains the successful task_create() return value, TASK_CREATE can\nincorrectly report success although the task was discarded.\n\nPreserve the fd allocation errors and call task_free() when failure\noccurs after a successful task_create() callback.\n\n## Affected\n\n- `Linux >= 04177158cf98a79744937893b100020d77e6f9ac < b27a75d42044d9d4709095617730b91b1c4af423`\n- `Linux >= 04177158cf98a79744937893b100020d77e6f9ac < 426a9947a38d272d0e19c031658da68e31128667`\n- `Linux >= 04177158cf98a79744937893b100020d77e6f9ac < 4a60127debb9e370d6c0e22a307326b624a141f3`\n- `Linux 6.13`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}