---
id: CVE-2026-64485
title: 'ALSA: compress: Fix task creation error unwind'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ALSA: compress: Fix task creation error unwind

  snd_compr_task_new() allocates the driver task before validating the
  returned DMA buffers and reserving file descriptors…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 04177158cf98a79744937893b100020d77e6f9ac <
    b27a75d42044d9d4709095617730b91b1c4af423
  - >-
    Linux >= 04177158cf98a79744937893b100020d77e6f9ac <
    426a9947a38d272d0e19c031658da68e31128667
  - >-
    Linux >= 04177158cf98a79744937893b100020d77e6f9ac <
    4a60127debb9e370d6c0e22a307326b624a141f3
  - Linux 6.13
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:41:21.913434Z'
published: '2026-07-25'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:38.298Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64485'
references:
  - url: 'https://git.kernel.org/stable/c/b27a75d42044d9d4709095617730b91b1c4af423'
  - url: 'https://git.kernel.org/stable/c/426a9947a38d272d0e19c031658da68e31128667'
  - url: 'https://git.kernel.org/stable/c/4a60127debb9e370d6c0e22a307326b624a141f3'
tags:
  - cve.org
epss: 0.00173
epssPercentile: 0.06329
ingestedAt: '2026-10-16T17:24:46.823Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ALSA: compress: Fix task creation error unwind

snd_compr_task_new() allocates the driver task before validating the
returned DMA buffers and reserving file descriptors. When either of
those later steps fails, the core frees its task wrapper and DMA-buffer
references without calling the driver's task_free() callback. Any
driver resources allocated by task_create() are therefore leaked.

The dual-fd allocation path also jumps to cleanup without storing the
negative get_unused_fd_flags() result in retval. Since retval still
contains the successful task_create() return value, TASK_CREATE can
incorrectly report success although the task was discarded.

Preserve the fd allocation errors and call task_free() when failure
occurs after a successful task_create() callback.

## Affected

- `Linux >= 04177158cf98a79744937893b100020d77e6f9ac < b27a75d42044d9d4709095617730b91b1c4af423`
- `Linux >= 04177158cf98a79744937893b100020d77e6f9ac < 426a9947a38d272d0e19c031658da68e31128667`
- `Linux >= 04177158cf98a79744937893b100020d77e6f9ac < 4a60127debb9e370d6c0e22a307326b624a141f3`
- `Linux 6.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.