The flaw occurs when acomp_save_req mistakenly stores the address of a request chain element instead of the request itself in req->base.data. When the asynchronous completion handler acomp_reqchain_done is invoked, it interprets this data pointer as a struct acomp_req, causing subsequent field accesses to use incorrect offsets. This results in kernel memory corruption and manifests as a general protection fault. Based on the memory corruption, an attacker may be able to overwrite kernel memory, which could potentially lead to code execution or denial of service in a local context.

The flaw appears in Linux kernel versions that include the acomp crypto compression subsystem and that invoke the completion callback through a hardware accelerator using the DMA virtual address interface, such as the Intel QAT driver. An unpatched kernel that has such hardware support enabled at runtime is at risk. Kernels that do not compile this subsystem or do not load a hardware accelerator are not affected.

The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA KEV, while the CVSS score of 7.8 signals high severity. The flaw results in kernel memory corruption, which may enable privilege escalation or denial of service. The likely attack vector is a local process that can trigger crypto_acomp_compress, for example through a privileged application that interacts with the Intel QAT driver. This inference is based on the requirement to invoke a kernel crypto interface that is affected by the bug. Exploitation would therefore be limited to environments where appropriate privileges exist.