Executive brief
A memory corruption vulnerability was identified in the Linux kernel's cryptographic compression component. This component is responsible for handling data compression tasks, often using specialized hardware accelerators. An exploit could lead to a system crash or potentially allow for unauthorized memory access, impacting the stability and security of the operating system.
Technical details
A memory corruption vulnerability exists in the Linux kernel's crypto acomp (asynchronous compression) interface due to an incorrect pointer being stored in acomp_save_req(). The function incorrectly stores a pointer to a sub-member (&req->chain) instead of the parent request structure. When the asynchronous completion callback acomp_reqchain_done() is triggered—typically by hardware drivers like Intel QAT using DMA—it casts this pointer back to the full request structure. This results in field accesses at incorrect offsets, leading to memory corruption and general protection faults. The issue has been resolved by ensuring the correct request pointer is stored and retrieved during the asynchronous request lifecycle.
Affected products
- Linux Linux Kernel 6.14, 6.15, 6.16
Timeline
- 2026-04-16: other: Patch authored by Giovanni Cabiddu
- 2026-05-27: advisory: CVE-2026-46081 published by NVD