SB20260527110 - Type Confusion in Linux kernel crypto

Description

This security bulletin contains information about 1 vulnerability.

1) Type Confusion (CVE-ID: CVE-2026-46081)

CWE-ID: CWE-843 - Type confusion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to memory corruption in acomp_reqchain_done() when processing asynchronous compression request completion for requests using the DMA virtual address interface. A local user can trigger an asynchronous compression request through a hardware implementation such as the QAT driver to cause a denial of service.

The issue is triggered when the request follows the acomp_do_req_chain() path and the asynchronous completion callback receives a pointer to the chain member instead of the request structure.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1a2785e5985627f2265ba7775949601a29ba0d1e
• https://git.kernel.org/stable/c/343a5bf68a8ff9affcf2b70677ea4cf40c195ee4
• https://git.kernel.org/stable/c/d7e20b9bd6c990773cf0c09e2642250b8a70263d