CVE-2026-53046

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the ksmbd crypt message() function when using asynchronous hardware crypto engines, such as the Qualcomm Crypto Engine (QCE). The function sets a NULL completion callback on AEAD requests and fails to properly handle the -EINPROGRESS return code. When the QCE returns -EINPROGRESS, the system incorrectly treats it as an error and frees the request while the hardware DMA (Direct Memory Access) operation is still active. Subsequently, the DMA completion callback dereferences the freed memory, leading to a NULL pointer crash.

Recommendations Implement the crypto wait req() pattern using crypto req done() as the completion callback to correctly handle both synchronous and asynchronous crypto engines.