Executive brief
A vulnerability was identified in the Linux kernel's cryptographic compression component. Due to a technical mismatch in how the system organizes internal memory management functions, the kernel could potentially execute the wrong code when allocating or freeing memory for data compression. This could allow a local attacker to cause a system crash or potentially gain unauthorized access to sensitive information.
Technical details
The vulnerability arises from a layout inconsistency between the 'crypto_acomp_streams' and 'scomp_alg' structures in the Linux kernel's crypto API. When structure layout randomization is enabled, the 'alloc_ctx' and 'free_ctx' function pointers in 'scomp_alg' (a pure ops structure) may be reordered, while the corresponding pointers in 'crypto_acomp_streams' are not. This mismatch leads to the kernel calling the wrong function during compression context operations. A local attacker with low privileges could exploit this to cause memory corruption or kernel instability. The fix involves removing the union in 'scomp_alg' to ensure both structures share a consistent definition and layout.
Affected products
- Linux Linux Kernel 6.16 to 6.17.3
Timeline
- 2025-09-08: disclosed: Initial patch authored
- 2025-10-28: advisory: CVE published by kernel.org and NVD