PT-2026-43948 · Linux+1 · Linux Kernel+1

Published 2026-05-27 · Updated 2026-05-27 · CVE-2026-46081

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory corruption issue exists in the Linux kernel crypto acomp component. The function acomp save req() incorrectly stores the address of the chain member (&req->chain) in req->base.data. When acomp reqchain done() is called during asynchronous completion, it casts this pointer directly to a struct acomp req. Because the pointer refers to the chain member rather than the start of the structure, subsequent field accesses occur at incorrect offsets. This occurs specifically when an asynchronous hardware implementation, such as the QAT driver, completes a request using the DMA virtual address interface (e.g., acomp request set src dma()), leading crypto acomp compress() to use the acomp do req chain() path.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-46081

Affected Products

Linux Kernel

Qat Driver

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-46081 · Security Note
• https://twitter.com/vuldb/status/2059712027837542410 · Twitter Post
• https://git.kernel.org/stable/c/d7e20b9bd6c990773cf0c09e2642250b8a70263d · Note
• https://git.kernel.org/stable/c/1a2785e5985627f2265ba7775949601a29ba0d1e · Note
• https://git.kernel.org/stable/c/343a5bf68a8ff9affcf2b70677ea4cf40c195ee4 · Note