CVE-2026-64485: ALSA: compress: Fix task creation error unwind
In the Linux kernel, the following vulnerability has been resolved:
ALSA: compress: Fix task creation error unwind
sndcomprtasknew() allocates the driver task before validating the returned DMA buffers and reserving file descriptors. When either of those later steps fails, the core frees its task wrapper and DMA-buffer references without calling the driver's taskfree() callback. Any driver resources allocated by taskcreate() are therefore leaked.
The dual-fd allocation path also jumps to cleanup without storing the negative getunusedfdflags() result in retval. Since retval still contains the successful taskcreate() return value, TASKCREATE can incorrectly report success although the task was discarded.
Preserve the fd allocation errors and call taskfree() when failure occurs after a successful taskcreate() callback.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64485?
The severity of CVE-2026-64485 is high, with a score of 7.8 according to CVSS 3.1.
What is the impact of CVE-2026-64485?
CVE-2026-64485 can lead to potential information disclosure and denial of service due to improper task management in the ALSA compress component.
How do I fix CVE-2026-64485?
To fix CVE-2026-64485, update the Linux kernel to the latest version that includes the appropriate patch for this vulnerability.
Which component is affected by CVE-2026-64485?
CVE-2026-64485 affects the ALSA compress component of the Linux kernel.
When was CVE-2026-64485 published?
CVE-2026-64485 was published on July 25, 2026.