The Linux kernel crypto subsystem's acomp module had a vulnerability (CVE-2026-90069) where ACOMP_REQUEST_ON_STACK() reserved storage only for synchronous fallback requests. When an asynchronous implementation is selected, the cloning function acomp_request_clone() copied only the stack-sized object, omitting storage for the async provider request context. This caused providers like QAT to write out-of-bounds, as confirmed by KASAN slab OOB write reports. The fix involved allocating a zeroed clone large enough for the runtime request size, copying only the source object's bytes, and maintaining fallback-on-allocation-failure behavior. This prevents out-of-bounds writes and potential memory corruption.

The vulnerability allows out-of-bounds memory writes in the kernel crypto subsystem when asynchronous crypto requests are cloned. This can lead to memory corruption, potentially causing system instability, crashes, or privilege escalation. The CVSS score of 7.8 indicates high severity with impacts on confidentiality, integrity, and availability. No known exploits in the wild have been reported.

A fix for this vulnerability has been implemented in the Linux kernel by correcting the allocation size during cloning of async requests in the acomp module. Users should apply the official kernel updates that include this patch. Since this is a kernel-level issue, upgrading to a patched kernel version is the recommended remediation. No alternative mitigations are indicated.