Linux kernel acomp: stack-request clone is undersized, letting async offload drivers write past the slab object

Impact

acomp_request_clone() copies only the stack-sized request object, so when an asynchronous compression provider is selected at runtime the clone has no room for that provider's request context. Drivers such as Intel QAT then write past the end of the allocation through acomp_request_ctx(), which KASAN reports as a slab out-of-bounds write. On a GPU node this matters where compression offload hardware is in use (QAT accelerators alongside GPUs for storage or network compression paths) or where in-kernel compressed swap/zswap is configured: a heap write of attacker-influenced size in kernel slab memory is a privilege-escalation primitive, and the NVD record scores it as local, low-complexity, high on confidentiality, integrity and availability. The record describes the corruption mechanism only; it does not demonstrate an exploit.

Who can reach it

Local user on the host or in a container able to drive a kernel compression path that falls back from the synchronous stack request to an async provider (for example via the crypto user API or compressed swap). Authentication as a local user is required; there is no remote vector in the record.

What to do

Apply the stable kernel update containing the acomp clone fix (commits 889fa17a0af0, d48197cbd5d3, ee440d4fc0d2) from your distribution and reboot the node; the fix is in the crypto core, so there is no module-reload or live-patch path published in the record. Schedule it with normal node drain and reboot maintenance. The record names no fixed release numbers, only the stable commits.

References

Related entries

• Linux kernel XDP: BPF_LINK_UPDATE bypasses offload checks, putting a device-bound program on the software pathCVE-2026-90146 · Linux kernel bpf/xdp (bpf_xdp_link_update offload checks)High
• Linux kernel BPF verifier (atomic RMW destination pointer type tracking): The verifier recorded an instruction'sCVE-2026-90177 · Linux kernel BPF verifier (atomic RMW destination pointer type tracking)High
• Linux kernel BPF: use-after-free when multi-attach trampoline update fails and the still-live old image is freedCVE-2026-90210 · Linux kernel BPF trampoline (bpf_trampoline_multi_attach_free on update failure)High
• Linux kernel BPF verifier: iterator stack slots compared without pointer type, pruning an unsafe pathCVE-2026-90217 · Linux kernel BPF verifier (STACK_ITER slot type comparison during state pruning)High
• Linux kernel NVMe: SUBMIT_IO skips the command permission check, allowing writes through read-only handlesCVE-2026-90227 · Linux kernel NVMe ioctl (NVME_IOCTL_SUBMIT_IO missing nvme_cmd_allowed() check)High
• Linux kernel IOMMU DMA: unlocked msi_page_list corruption with two devices in one VFIO containerCVE-2026-90244 · Linux kernel iommu/dma (MSI page list locking under VFIO type1)High