CVE-2026-64485: Linux Kernel Privilege Escalation Flaw

CVE-2026-64485 Overview

CVE-2026-64485 affects the Advanced Linux Sound Architecture (ALSA) compress offload subsystem in the Linux kernel. The flaw resides in snd_compr_task_new(), which allocates a driver task before validating returned DMA buffers and reserving file descriptors. When those later steps fail, the kernel frees its task wrapper and DMA buffer references without invoking the driver's task_free() callback, leaking any driver resources allocated by task_create().

A second defect in the dual-fd allocation path fails to store the negative get_unused_fd_flags() result in retval, causing TASK_CREATE to incorrectly report success even after the task was discarded.

Critical Impact
Local low-privileged users can trigger driver resource leaks and receive incorrect success status for discarded ALSA compress tasks, potentially leading to memory corruption or denial of service.

Affected Products

Linux kernel ALSA compress offload subsystem
Distributions shipping affected upstream Linux kernel versions prior to fix commits
Systems using compress-offload capable audio drivers

Discovery Timeline

2026-07-25 - CVE-2026-64485 published to the National Vulnerability Database
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64485

Vulnerability Analysis

The vulnerability exists in the ALSA compress offload interface, which allows userspace to submit compressed audio tasks to hardware-accelerated codecs. The snd_compr_task_new() function follows an incorrect error-unwind ordering during task creation.

The function first calls the driver's task_create() callback, which may allocate driver-specific resources. It then validates the returned DMA buffers and reserves file descriptors through get_unused_fd_flags(). When either post-allocation step fails, the cleanup path frees the core task wrapper and DMA buffer references but never calls the driver's task_free() callback, orphaning any driver resources previously allocated.

A related logic error affects the dual-fd allocation path. When get_unused_fd_flags() returns a negative error code, the path jumps to cleanup without storing that error into retval. Because retval still holds the successful return value from task_create(), the TASK_CREATE ioctl reports success to userspace even though the kernel discarded the task.

Root Cause

The root cause is improper error unwind ordering combined with a missing return-value assignment. The core assumes ownership semantics that do not match the driver contract, and one error branch neglects to propagate the failure code.

Attack Vector

Exploitation requires local access with permission to open ALSA compress device nodes such as /dev/snd/comprC*D*. A local attacker can repeatedly invoke the SNDRV_COMPRESS_TASK_CREATE ioctl under conditions that fail DMA buffer validation or exhaust the file descriptor table, forcing the leak path. Sustained exploitation may exhaust driver memory pools or leave stale driver state that userspace believes is valid, enabling further memory-safety issues.

No public proof-of-concept exploit is available. See the upstream fix commits referenced below for technical details.

Detection Methods for CVE-2026-64485

Indicators of Compromise

Unexpected growth in kernel slab allocations tied to compress-offload driver caches
Repeated SNDRV_COMPRESS_TASK_CREATE ioctl calls from unprivileged processes followed by fd-table pressure
Audio subsystem instability, driver resource warnings, or kernel log entries from the ALSA compress core

Detection Strategies

Audit process invocations of ALSA compress device nodes under /dev/snd/ from non-audio service accounts
Monitor dmesg and journal output for compress-offload driver warnings and reference count anomalies
Track /proc/slabinfo deltas for sound driver caches to identify sustained growth consistent with leaks

Monitoring Recommendations

Ingest kernel logs and audit records into a centralized SIEM to correlate ioctl activity with resource growth
Baseline normal audio subsystem behavior on multimedia hosts to surface deviations quickly
Alert on unprivileged processes issuing high volumes of sound-device ioctls

How to Mitigate CVE-2026-64485

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the kernel.org commit 426a9947, commit 4a60127d, and commit b27a75d4
Update to a distribution kernel that incorporates the ALSA compress task creation error unwind fix
Restrict access to /dev/snd/compr* device nodes to trusted users and audio service accounts only

Patch Information

The fix preserves the file descriptor allocation error code in retval and invokes the driver's task_free() callback when failure occurs after a successful task_create(). Three stable-tree commits address the issue across supported kernel branches. Rebuild and reboot affected systems after applying the patched kernel.

Workarounds

Remove or blacklist compress-offload audio driver modules on systems that do not require hardware audio acceleration
Enforce strict group ownership and permissions on /dev/snd/ nodes through udev rules to limit local exposure
Constrain container and sandbox profiles (seccomp, AppArmor, SELinux) to block the SNDRV_COMPRESS_TASK_CREATE ioctl where not required

bash

# Verify running kernel version and audit compress device access
uname -r
ls -l /dev/snd/compr*

# Example udev rule tightening compress device permissions
# /etc/udev/rules.d/60-alsa-compress.rules
# KERNEL=="compr*", GROUP="audio", MODE="0660"