The flaw occurs when acomp_save_req mistakenly stores the address of a request chain element instead of the request itself in req->base.data. When the asynchronous completion handler acomp_reqchain_done is invoked, it interprets this data pointer as a struct acomp_req, causing all subsequent field accesses to use incorrect offsets. This results in kernel memory corruption and manifests as a general protection fault. It is inferred that the corrupted kernel memory could be overwritten, potentially allowing a local attacker who can trigger the crypto_acomp_compress path to execute arbitrary code or crash the system.

The vulnerability affects all Linux kernel releases that include the acomp crypto compression subsystem and use the DMA virtual address interface with hardware accelerators such as the Intel QAT driver. Any system running an unpatched kernel that has such hardware support enabled is at risk.

The EPSS score of 0.00017 indicates a very low probability of exploitation and the vulnerability is not listed in CISA KEV, and the CVSS severity is 7.8. The nature of the fault indicates a high impact: kernel memory corruption, which can lead to privilege escalation or denial of service. The likely attack vector is a local process capable of invoking the crypto_acomp_compress path, for example through a privileged application or service that interacts with the QAT driver. Because the flaw is within the kernel's crypto subsystem, exploitation would require the attacker to have sufficient privileges to initiate a crypto request; therefore, the risk is high for systems where such privileged access is possible.