Linux Kernel CVE-2026-46081

Exploitation requires local low-privileged access (CVSS PR:L) to a Linux 6.16+ system that has an asynchronous hardware compression accelerator active, specifically the Intel QAT driver (intel_qat), AND the workload must invoke the acomp DMA virtual address interface (e.g., acomp_request_set_src_dma()) which drives crypto_acomp_compress() into the acomp_do_req_chain() path. Systems without QAT hardware/driver loaded, or without software paths that exercise async acomp with DMA addressing, are not exposed. No user interaction is required (UI:N) once the local attacker can submit crypto requests, but the requirement for QAT-enabled servers (typically datacenter, cloud, or networking appliances) significantly narrows the realistic attack surface compared to a generic Linux flaw.

Signals point to a moderate-to-high local-impact bug with low real-world urgency. CVSS 7.8 (AV:L/AC:L/PR:L/UI:N) indicates local attacker with low privileges and no user interaction can cause high impact across CIA - consistent with kernel memory corruption. However, EPSS is 0.02% (4th percentile), reflecting that exploitation in practice is unlikely and no public exploit identified at time of analysis. The bug is not in CISA KEV. A meaningful limiting factor: triggering the bug requires a specific code path - asynchronous hardware crypto offload (e.g., QAT) combined with the DMA virtual address acomp interface - which is not present on most general-purpose deployments. Memory corruption manifests as a general protection fault under KASAN, suggesting the most likely outcome is a denial-of-service crash, though kernel memory corruption bugs can sometimes be escalated to privilege escalation with skilled exploitation. Confidence note: the CVSS vector is the only formal severity signal; no CWE is assigned, and exploitability for code execution (vs. crash) is unverified.

A local user with low privileges on a Linux system equipped with an Intel QAT accelerator submits a crafted asynchronous compression request via the kernel crypto API (e.g., through AF_ALG or a userspace zswap/zram path that uses QAT-backed acomp with DMA virtual addresses). On completion, the kernel callback acomp_reqchain_done() dereferences the malformed pointer at the wrong offset, leading to memory corruption that crashes the kernel or - with careful heap shaping - may be coaxed into privilege escalation. No public exploit identified at time of analysis; the primary observed effect is a KASAN-detected general protection fault.