Executive brief
The Linux kernel's async compression (acomp) component contains a buffer overflow vulnerability when cloning compression requests. Attackers can leverage this to write beyond allocated memory boundaries, potentially causing kernel crashes or code execution with privileges equivalent to the kernel.
Technical details
The vulnerability exists in the acomp_request_clone() function in crypto/acompress.c. When an async compression implementation is selected, the function clones a stack-allocated request object but fails to allocate sufficient storage for the async provider's request context. Specifically, ACOMP_REQUEST_ON_STACK() allocates only enough space for synchronous fallback, but async providers such as QAT require additional context storage. The original clone operation copies only the stack-sized object, leaving no room for the provider context. Providers then write past the allocation boundary through acomp_request_ctx(), triggering out-of-bounds writes detected by KASAN. The fix allocates a properly-sized clone buffer using kzalloc() with runtime reqsize and copies only the necessary bytes.
Affected products
- Linux Linux kernel multiple versions (patch available in stable branches)
Timeline
- 2026-09-17: disclosed: CVE-2026-90069 published
- 2026-09-14: patched: Fix commit 889fa17a0af09ff93a9166abc82ee7a654faa49b merged to stable branches