The Linux kernel ALSA compress subsystem contained a vulnerability in the snd_compr_task_new() function where driver tasks were allocated before validating DMA buffers and reserving file descriptors. If validation failed, the core freed task wrappers and DMA-buffer references without invoking the driver's task_free() callback, causing resource leaks. Furthermore, the dual file descriptor allocation path failed to preserve negative error codes, resulting in false success reports despite task discard. The fix involves preserving file descriptor allocation errors and calling task_free() upon failure after a successful task_create() callback.

The vulnerability causes resource leaks in the ALSA compress driver due to improper error handling during task creation. This may lead to degraded system stability or resource exhaustion over time. There is no indication of direct code execution or privilege escalation impact. No known exploits are reported in the wild.

A fix for this vulnerability has been implemented in the Linux kernel. Users should update to the fixed kernel version once available. Patch status is not explicitly confirmed in the provided data; therefore, check the official Linux kernel advisories or vendor updates for the exact fixed versions and remediation guidance.