GHSA-pp4v-xc4h-7x6m · 深刻度： high — In the Linux kernel, the following vulnerability has been resolved: crypto: acomp - fix wrong...
In the Linux kernel, the following vulnerability has been resolved: crypto: acomp - fix wrong pointer stored by acomp_save_req() acomp_save_req() stores &req->chain in req->base.data. When acomp_reqchain_done() is invoked on asynchronous completion, it receives &req->chain as the data argument but casts it directly to struct acomp_req. Since data points to the chain member, all subsequent field accesses are at a wrong offset, resulting in memory corruption. The issue occurs when an asynchronous hardware implementation, such as the QAT driver, completes a request that uses the DMA virtual address interface (e.g. acomp_request_set_src_dma()). This combination causes crypto_acomp_compress() to enter the acomp_do_req_chain() path, which sets acomp_reqchain_done() as the completion callback via acomp_save_req(). With KASAN enabled, this manifests as a general protection fault in acomp_reqchain_done(): general protection fault, probably for non-canonical address 0xe000040000000000 KASAN: probably user-memory-access in range [0x0000400000000000-0x0000400000000007] RIP: 0010:acomp_reqchain_done+0x15b/0x4e0 Call Trace: <IRQ> qat_comp_alg_callback+0x5d/0xa0 [intel_qat] adf_ring_response_handler+0x376/0x8b0 [intel_qat] adf_response_handler+0x60/0x170 [intel_qat] tasklet_action_common+0x223/0x820 handle_softirqs+0x1ab/0x640 </IRQ> Fix this by storing the request itself in req->base.data instead of &req->chain, so that acomp_reqchain_done() receives the correct pointer. Simplify acomp_restore_req() accordingly to access req->chain directly.
総合評価: CVE-2026-46081 は低リスク（33.3/100）。CVSS 深刻度は高。悪用される可能性が高い（EPSS 0.16%、6 パーセンタイル） 推奨対応: 悪用情報と EPSS の推移を監視し、必要に応じて優先度を見直してください。
リスクは変動します。再評価に基づき、本ページの表示内容を更新しています。
EPSS は日次で悪用されやすさの相対度合いを推定します。パーセンタイルは採点済み CVE の中での相対位置（高いほど相対的に深刻）を示します。
| # | 日付 | 旧 EPSS スコア | 新 EPSS スコア | Δ（新 − 旧） |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.02% | 0.16% | +0.14% |
| 2 | 2026-05-28 | — | 0.02% | — |
EPSS の全履歴 （全 2 件）
この CVE の CVSS 指標。
| ベーススコア | バージョン | 深刻度 | ベクトル | 悪用しやすさ | 影響 | スコアの出典 |
|---|---|---|---|---|---|---|
| 7.8 | 3.1 | HIGH |
|
1.8 | 5.9 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
GHSA-pp4v-xc4h-7x6m · 深刻度： high — In the Linux kernel, the following vulnerability has been resolved: crypto: acomp - fix wrong...
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
unimportant | CVE-2026-46081 unimportant priority: Debian including 1 source packages (linux), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2026-46081 |
redhat
|
— | — | https://access.redhat.com/security/cve/CVE-2026-46081 |
suse
|
medium | CVE-2026-46081 severity moderate: SUSE including 21 source package names (cluster-md-kmp-default, dlm-kmp-default, …), 199 product×package rows across 40 product lines (SUSE Linux Enterprise High Availability Extension 15 SP7, SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS, … (40 product lines)): Known Not Affected 199. | https://www.suse.com/security/cve/CVE-2026-46081/ |
ubuntu
|
medium | CVE-2026-46081 medium priority: Ubuntu including 158 source packages (linux, linux-allwinner-5.19, …), 1422 status rows across 9 suites (bionic, focal, jammy, noble, questing, resolute, trusty, upstream, xenial): DNE 1024, ignored 169, not-affected 115, released 84, needed 24, pending 6. | https://ubuntu.com/security/CVE-2026-46081 |
| ベンダー | 製品 | バージョン | 生の CPE |
|---|---|---|---|
| linux | linux_kernel | >= 6.16, < 6.18.27 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | >= 6.19, < 7.0.4 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |