CVE-2026-90069 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel infrastructure, particularly those with async implementations selected, should assess exposure and prioritize patching. This includes operators, platform administrators, vulnerability management teams, and security teams. They should verify and apply patches for Linux kernel versions affected by this vulnerability to prevent potential slab OOB write errors.

Why it matters

Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly those with async implementations selected, to prevent potential slab OOB write errors.

• Verify async implementation usage in Linux kernel versions
• Assess exposure and prioritize patching for affected versions
• Monitor system logs for potential slab OOB write errors

Technical summary

The Linux kernel crypto: acomp component has a vulnerability related to async request context allocation when cloning. Allocate a zeroed clone large enough for the runtime acomp request size, copy only the bytes present in the source object, and preserve the existing fallback-on-allocation-failure behavior. This vulnerability could potentially allow attackers to cause slab OOB write errors. The vulnerability was addressed by allocating a larger clone size to accommodate async provider request context. The existing fallback-on-allocation-failure behavior is preserved.

Defensive priority

Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly those with async implementations selected.

Recommended defensive actions

• Verify Linux kernel versions for async implementation usage
• Apply patches for affected Linux kernel versions
• Monitor system logs for potential slab OOB write errors
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was reported through the Linux kernel stable reference links provided in the source references. The report included details about the async request context allocation issue in the crypto: acomp component. The vulnerability allows for a potential slab OOB write error. Evidence is limited to public sources and may not be comprehensive.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.