The vulnerability arises in the ALSA compression driver within the Linux kernel. The snd_compr_task_new() routine allocates a driver task before validating DMA buffers and reserving file descriptors. If either validation fails, the kernel frees only the wrapper and DMA buffers but never calls the driver's task_free() callback, leading to a leak of driver‑specific resources. Moreover, on the dual‑FD allocation path a failed get_unused_fd_flags() error is not propagated correctly, causing the task_create function to report success even though the task was discarded. This allows a user to repeatedly trigger the bug and cause memory or file‑descriptor exhaustion, eventually degrading system performance or availability.

The issue affects any Linux kernel iteration that includes the ALSA snd_compr compression driver prior to the patch. This includes current kernel releases for which the patch is not yet integrated. The fix is present in commit 426a9947a38d272d0e19c031658da68e31128667 and subsequent kernel releases that incorporate this change.

Based on the description, it is inferred that the primary attack vector is local access to the ALSA interface with kernel privileges, as the vulnerability involves task creation requests to the ALSA driver. The EPSS score of less than 1% and absence from CISA KEV suggest a low likelihood of active exploitation. Although exploitation does not provide code execution or privilege escalation, repeated successful attempts can exhaust kernel resources, potentially leading to a denial‑of‑service condition.