The QAT crypto driver in the Linux kernel protects the service_table list only when adding or removing entries. Several functions iterate over this list without holding the service_lock, allowing a concurrent adf_service_register or adf_service_unregister to modify the list during traversal. This race can corrupt the linked list or trigger a use‑after‑free, resulting in kernel memory corruption. Such corruption might crash the kernel or, in a worst‑case scenario, provide a vehicle for arbitrary kernel code execution.

The vulnerability is present in the Linux kernel’s QAT crypto driver. No specific kernel version range is provided, so any kernel that includes the unpatched QAT code before the fix is potentially affected.

The CVSS score of 7.0 gives the vulnerability a high severity classification. The EPSS score is less than 1%, indicating a low likelihood of exploitation in the wild. The issue is not listed in CISA's KEV catalog. Exploitation would require an attacker to trigger concurrent service registration and unregistration, which likely demands local privileged access or the ability to execute code that interacts with the QAT subsystem. Due to these constraints, the attack vector is presumably local, but the exact access requirements are not fully specified in the advisory.