The vulnerability arises in the ALSA compression driver within the Linux kernel. The snd_compr_task_new() routine allocates a driver task before validating DMA buffers and reserving file descriptors. If either validation fails, the kernel frees only the wrapper and DMA buffers but never calls the driver's task_free() callback, resulting in a leak of driver‑specific resources. Additionally, on the dual‑FD allocation path a failed get_unused_fd_flags() error is not propagated correctly, causing the task_create function to report success even though the task was discarded. This flaw allows a user to repeatedly trigger the bug and exhaust kernel memory or file descriptors, eventually degrading system performance or availability.

The issue impacts any Linux kernel iteration that includes the ALSA snd_compr compression driver prior to the patch. This includes current kernel releases for which the patch has not yet been integrated. The fix is present in commit 426a9947a38d272d0e19c031658da68e31128667 and subsequent kernel releases that incorporate this change.

The CVSS score of 7.8 indicates high severity, pointing to significant risk of resource exhaustion if the bug is exploited. Based on the description, the likely attack vector is local user‑level access to the ALSA interface, as the vulnerability arises from malformed ALSA compression task creation requests. The EPSS score of less than 1% and the absence from the CISA KEV catalog suggest a low probability of active exploitation. Although the flaw does not provide code execution or privilege escalation, repeated successful attempts can exhaust kernel memory or file descriptors, potentially leading to a denial‑of‑service condition.