The flaw occurs when acomp_save_req stores the address of a request chain element rather than the request itself, causing the completion callback acomp_reqchain_done to interpret the data pointer incorrectly. The resulting misaligned field accesses corrupt kernel memory and trigger a general protection fault. An attacker with sufficient privilege to initiate the crypto_acomp_compress path, especially via an asynchronous hardware interface such as Intel QAT, could exploit this to write arbitrary data to kernel memory, potentially leading to privilege escalation or denial of service.

The vulnerability affects the Linux kernel across all versions that implement the acomp crypto compression subsystem and interact with hardware drivers that use the DMA virtual address interface, such as the Intel QAT driver. Any system running a kernel that has not applied the described patch is potentially impacted.

The missing EPSS score and lack of KEV listing do not diminish the severity implied by a kernel memory corruption issuance. CVSS metrics are not provided, but the nature of the fault suggests a high impact and a local exploit vector requiring the attacker to trigger a kernel crypto compression request. Given the use of specialized hardware drivers, exploitation may be limited to systems with those components enabled, yet the potential for arbitrary code execution in kernel context warrants high risk.