CVE-2026-46081: crypto: acomp - fix wrong pointer stored by acomp_save_req()

Synopsis

A wrong-pointer bug in the Linux kernel's asynchronous compression subsystem (crypto/acomp) allows a local attacker with a low-privilege account to trigger memory corruption. The flaw is reachable locally and requires no network access; it manifests when an asynchronous hardware compression driver, such as the Intel QAT driver, completes a request that was set up using the DMA virtual address interface, causing the completion callback to dereference a structurally offset pointer. Successful exploitation gives the attacker full read, write, and denial-of-service capability over kernel memory. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running an affected kernel.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access is required to reach the vulnerable code path.

• AuthenticationRequired

  Any low-privilege local account is sufficient to trigger the asynchronous compression request that leads to the wrong-pointer dereference.

• Victim interactionNot required

  No victim interaction is needed; the attacker triggers the flaw entirely through their own process actions.

• Attack complexityDetail

  The exploit is reliable and condition-free once the attacker has a local account and the QAT (or similar async hardware) driver is active; no race conditions or memory-layout tuning are required.

Blast Radius

• Reads arbitrary kernel memory, exposing credentials, cryptographic keys, and other sensitive in-memory data.
• Writes to arbitrary kernel memory locations, allowing the attacker to overwrite security-critical structures or inject code into kernel context.
• Crashes the affected kernel or specific subsystems via memory corruption, causing a full system denial of service.
• Provides a strong primitive for privilege escalation from a low-privilege process to full kernel control.