High 7.8Published Sep 17, 2026

CVE-2026-90069crypto: acomp - allocate async request context when cloning

Updated under an hour ago (2026-10-19 06:20 UTC)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: crypto: acomp - allocate async request context when cloning ACOMP_REQUEST_ON_STACK() reserves only enough storage for the synchronous fallback. When an async implementation is selected, callers clone that stack request before retrying, but acomp_request_clone() currently copies only the stack-sized object. The clone therefore has no storage for the async provider request context, and providers such as QAT write past the allocation through acomp_request_ctx(). KASAN does report a slab OOB write. Allocate a zeroed clone large enough for the runtime acomp request size, copy only the bytes present in the source object, and preserve the existing fallback-on-allocation-failure behavior. Use the runtime reqsize because an implementation may adjust it during tfm initialization.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Sep 18, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 097c432caaa6d91f87732fe991cb08139e31101a before d48197cbd5d3476c7deea644972e9ec510865ec2; from 097c432caaa6d91f87732fe991cb08139e31101a before 889fa17a0af09ff93a9166abc82ee7a654faa49b; from 097c432caaa6d91f87732fe991cb08139e31101a before ee440d4fc0d2f15894ab1f64c474a3adbc858880	CNA record

References

https://git.kernel.org/stable/c/d48197cbd5d3476c7deea644972e9ec510865ec2
https://git.kernel.org/stable/c/889fa17a0af09ff93a9166abc82ee7a654faa49b
https://git.kernel.org/stable/c/ee440d4fc0d2f15894ab1f64c474a3adbc858880

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.