Riskcovery

CVE-2026-90069

crypto: acomp - allocate async request context when cloning

State
Published
Severity
7.8 High
Published
Sep 17, 2026
Updated
Oct 19, 2026
Reserved
Sep 11, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: acomp - allocate async request context when cloning

ACOMP_REQUEST_ON_STACK() reserves only enough storage for the synchronous fallback. When an async implementation is selected, callers clone that stack request before retrying, but acomp_request_clone() currently copies only the stack-sized object. The clone therefore has no storage for the async provider request context, and providers such as QAT write past the allocation through acomp_request_ctx(). KASAN does report a slab OOB write.

Allocate a zeroed clone large enough for the runtime acomp request size, copy only the bytes present in the source object, and preserve the existing fallback-on-allocation-failure behavior. Use the runtime reqsize because an implementation may adjust it during tfm initialization.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 097c432caaa6d91f87732fe991cb08139e31101a to before d48197cbd5d3476c7deea644972e9ec510865ec2Affected
  • 097c432caaa6d91f87732fe991cb08139e31101a to before 889fa17a0af09ff93a9166abc82ee7a654faa49bAffected
  • 097c432caaa6d91f87732fe991cb08139e31101a to before ee440d4fc0d2f15894ab1f64c474a3adbc858880Affected
LinuxLinux
  • 6.16Affected
  • before 6.16Not affected
  • 6.18.52 through 6.18.*Not affected
  • 7.2.6 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.