CVE-2026-46081

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

crypto: acomp - fix wrong pointer stored by acomp_save_req()

acomp_save_req() stores &req->chain in req->base.data. When

acomp_reqchain_done() is invoked on asynchronous completion, it receives

&req->chain as the data argument but casts it directly to struct

acomp_req. Since data points to the chain member, all subsequent field

accesses are at a wrong offset, resulting in memory corruption.

The issue occurs when an asynchronous hardware implementation, such as

the QAT driver, completes a request that uses the DMA virtual address

interface (e.g. acomp_request_set_src_dma()). This combination causes

crypto_acomp_compress() to enter the acomp_do_req_chain() path, which

sets acomp_reqchain_done() as the completion callback via

acomp_save_req().

With KASAN enabled, this manifests as a general protection fault in

acomp_reqchain_done():

general protection fault, probably for non-canonical address 0xe000040000000000

K

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References