CVE-2026-46081 Overview
CVE-2026-46081 is a memory corruption vulnerability in the Linux kernel's asynchronous compression (acomp) crypto subsystem. The flaw exists in acomp_save_req(), which incorrectly stores &req->chain in req->base.data instead of the request pointer itself. When acomp_reqchain_done() runs as an asynchronous completion callback, it casts the stored pointer directly to struct acomp_req, causing all subsequent field accesses to occur at incorrect offsets.
The issue triggers when asynchronous hardware implementations such as the Intel QAT driver complete requests using the DMA virtual address interface. With Kernel Address Sanitizer (KASAN) enabled, this manifests as a general protection fault accessing non-canonical addresses.
Critical Impact
Memory corruption in kernel crypto code can lead to kernel panics, denial of service, and potentially privilege escalation on systems using hardware-accelerated compression such as Intel QAT.
Affected Products
- Linux kernel versions containing the affected acomp_save_req() implementation in the crypto subsystem
- Systems using asynchronous compression hardware drivers (notably Intel QAT via intel_qat)
- Workloads invoking acomp_request_set_src_dma() through the crypto API
Discovery Timeline
- 2026-05-27 - CVE-2026-46081 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-46081
Vulnerability Analysis
The vulnerability resides in the Linux kernel crypto API's asynchronous compression layer. acomp_save_req() is responsible for preserving request state before dispatching it to a hardware backend. It stores a pointer in req->base.data that the completion callback later retrieves.
The function incorrectly stored &req->chain (a pointer to the chain member inside the request structure) rather than the request pointer itself. On asynchronous completion, acomp_reqchain_done() retrieves this pointer and casts it directly to struct acomp_req *. Because chain is an interior member, every field access through this cast is offset incorrectly relative to the actual request structure.
The condition is reachable when a caller uses the DMA virtual address interface such as acomp_request_set_src_dma(). This routes crypto_acomp_compress() through acomp_do_req_chain(), which installs acomp_reqchain_done() as the completion handler via acomp_save_req().
Root Cause
The root cause is a pointer arithmetic error in acomp_save_req(). Storing the address of an interior structure member instead of the containing structure breaks the implicit contract with the completion callback, producing a type-confused pointer that the callback dereferences as if it pointed to the parent object.
Attack Vector
Triggering the bug requires submitting asynchronous compression requests through the kernel crypto API on a system with a hardware backend such as Intel QAT. The resulting general protection fault halts the affected execution context. The fix changes acomp_save_req() to store the request itself in req->base.data and simplifies acomp_restore_req() to access req->chain directly. See the kernel commit for the patch.
Detection Methods for CVE-2026-46081
Indicators of Compromise
- Kernel general protection faults with RIP at acomp_reqchain_done+0x15b/0x4e0 in dmesg or journalctl -k output
- KASAN reports indicating user-memory-access in non-canonical address ranges originating from acomp_reqchain_done()
- Call traces involving qat_comp_alg_callback, adf_ring_response_handler, and adf_response_handler from the intel_qat module
Detection Strategies
- Audit running kernel versions against the patched commits referenced in the stable kernel tree
- Monitor /var/log/kern.log and systemd journal for crash signatures involving the crypto acomp path
- Enable KASAN in non-production kernels to surface the memory access fault during testing of QAT-accelerated workloads
Monitoring Recommendations
- Track kernel panics and oops events on hosts running Intel QAT or other asynchronous compression accelerators
- Alert on repeated soft IRQ-context crashes associated with tasklet_action_common and handle_softirqs
- Correlate crypto subsystem faults with workloads using compression offload such as zswap, IPsec, or storage compression
How to Mitigate CVE-2026-46081
Immediate Actions Required
- Apply the upstream Linux kernel patch that corrects the pointer stored by acomp_save_req()
- Inventory systems using Intel QAT or other asynchronous compression hardware and prioritize patching
- Reboot affected hosts after kernel updates to load the corrected crypto subsystem code
Patch Information
The fix is available in the mainline and stable Linux kernel trees. Refer to the relevant commits: 1a2785e59856, 343a5bf68a8f, and d7e20b9bd6c9. The patch stores the request itself in req->base.data and adjusts acomp_restore_req() to access req->chain directly.
Workarounds
- Disable hardware compression offload by unloading the intel_qat module where operationally feasible: modprobe -r intel_qat
- Avoid kernel callers that route through acomp_do_req_chain() by reconfiguring services to use synchronous software compression
- Restrict access to features that exercise the asynchronous compression path until the patched kernel is deployed
# Verify whether the QAT driver is loaded and unload if mitigation is required
lsmod | grep intel_qat
sudo modprobe -r intel_qat
# Confirm running kernel version and apply distribution updates
uname -r
sudo apt update && sudo apt upgrade linux-image-$(uname -r | sed 's/-generic//')
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
