HIGH Introduced in 6.16
crypto RequestClone OOB
CVE-2026-90069
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: crypto: acomp - allocate async request context when cloning ACOMP_REQUEST_ON_STACK() reserves only enough storage for the synchronous fallback. When an async implementation is selected, callers clone that stack request before retrying, but acomp_request_clone() currently copies only the stack-sized object. The clone therefore has no storage for the async provider request context, and providers such as QAT write past the allocation through acomp_request_ctx(). KASAN does report a slab OOB write. Allocate a zeroed clone large enough for the runtime acomp request size, copy only the bytes present in the source object, and preserve the existing fallback-on-allocation-failure behavior. Use the runtime reqsize because an implementation may adjust it during tfm initialization.
02KernelScan AI Analysis
Risk summary
A local user who can trigger kernel compression operations on a system with an async compression provider (e.g., QAT hardware) can cause an out-of-bounds slab write. The corruption of kernel heap memory can lead to privilege escalation or system crash. Systems without async compression hardware configured are not affected.
Vulnerability analysis
When an asynchronous compression implementation is selected, cloning a stack-allocated compression request copies only the stack-sized object without reserving space for the async provider's private context. The provider then writes beyond the allocated buffer, producing a slab out-of-bounds write that can corrupt adjacent kernel heap objects. The fix allocates a zeroed clone large enough for the runtime request context size, copies only the valid source bytes, and falls back to the synchronous implementation if the allocation fails. The vulnerable path is reachable by local users who can trigger kernel compression operations when an async compression provider such as QAT hardware is configured on the system.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.16 | 6.18.52 | d48197cbd5d3 |
| 7.2 | 6.16 | 7.2.6 | 889fa17a0af0 |
| mainline | 6.16 | 7.3-rc1 | ee440d4fc0d2 |