The vulnerability is a use‑after‑free in the Linux kernel’s Intel QAT driver caused by a race condition between the VF‑to‑PF interrupt handler and the SR‑IOV teardown routine. When adf_disable_sriov() destroys per‑VF structures before queued work has finished, a concurrently scheduled worker can dereference freed memory, resulting in a kernel panic or, if the attacker can influence the context, arbitrary code execution. The flaw lies in adf_disable_sriov() by removing mutexes and freeing vf_info without first canceling or draining the work queue. When KASAN is enabled it surface as a null‑pointer dereference in mutex_lock, but without debugging information it quietly crashes the kernel.

The flaw affects any Linux kernel that ships the intel_qat driver, across distributions such as Red Hat, Ubuntu, SUSE and others, provided SR‑IOV is enabled for the QAT device and a workqueue is active. No specific kernel version bounds are given; all kernels that include the affected driver prior to the patch are vulnerable.

The CVSS score of 8.8 signals high severity. The EPSS score is below 1 %, indicating a low current probability of exploitation, and the issue is not listed in CISA KEV. Exploitation requires local or privileged access that allows the attacker to enable or disable SR‑IOV or to send crafted VF‑to‑PF messages that trigger the race. An attacker with such access on the host or a malicious virtual machine could cause a denial of service or elevate privileges to kernel context.