CVE-2026-64438 - Vulnerability Details

- crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()

Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()

The VF2PF interrupt handler queues PF-side response work that stores a
raw pointer to per-VF state (struct adf_accel_vf_info). Currently,
adf_disable_sriov() destroys per-VF mutexes and frees vf_info without
stopping new VF2PF work or waiting for in-flight workers to complete. A
concurrently scheduled or already queued worker can then dereference
freed memory.

This manifests as a use-after-free when KASAN is enabled:

BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0
Write of size 8 at addr 0000000000000260 by task kworker/24:2/...
Workqueue: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat]
Call Trace:
kasan_report+0x119/0x140
mutex_lock+0x76/0xe0
adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat]
adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat]
adf_iov_send_resp+0x8c/0xe0 [intel_qat]
process_one_work+0x6ac/0xfd0
worker_thread+0x4dd/0xd30
kthread+0x326/0x410
ret_from_fork+0x33b/0x670

Add a PF-local flag, vf2pf_disabled, that gates work queueing, worker
processing, and interrupt re-enabling during teardown. Set this flag
atomically with the hardware interrupt mask inside
adf_disable_all_vf2pf_interrupts(). After masking, synchronize the AE
cluster MSI-X interrupt and flush the PF response workqueue before
tearing down per-VF locks and state so all in-flight work completes
before vf_info is destroyed.

Introduce adf_enable_all_vf2pf_interrupts() to clear the flag and
unmask all VF2PF interrupts under the same lock when SR-IOV is
re-enabled. This ensures the software flag and hardware state transition
atomically on both the enable and disable paths.

Published: 2026-07-25

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A race between the VF‑to‑PF interrupt handler and the SR‑IOV teardown routine in the Linux intel_qat driver causes the driver to free per‑VF structures before queued work has finished. The resulting use‑after‑free can lead to a kernel panic or, if memory is overwritten, arbitrary code execution. This flaw falls under CWE‑416 and CWE‑825.

Affected Systems

All versions of the Linux kernel that ship the intel_qat driver prior to the patch are affected. The issue manifests when SR‑IOV is enabled and workers are queued in the qat_pf2vf_resp_wq workqueue.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity. The EPSS score of less than 1 % reflects a low present exploitation probability, and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the attack vector requires local or privileged access that allows toggling SR‑IOV or injecting crafted VF‑to‑PF messages from a virtual machine or host. An attacker with such access could trigger the race, causing a denial of service or potentially gaining kernel‑level execution.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`ed8ccaef52fa03fb03cff45b380f72c9f869f273`	affected	< 218c2836b3987f3fa1d9eac505462cded0821e4c
`ed8ccaef52fa03fb03cff45b380f72c9f869f273`	affected	< 446b4d77599cf1a168573f7fb32a4a6aa4f09219
`ed8ccaef52fa03fb03cff45b380f72c9f869f273`	affected	< 5d916c1eae1933511a69bffe243b4ee5d7da399c
`ed8ccaef52fa03fb03cff45b380f72c9f869f273`	affected	< f344a369d0380d54c8d6c8d24734a78dd5a89817
`ed8ccaef52fa03fb03cff45b380f72c9f869f273`	affected	< 51144032248cc4ea22917370565650670b8b4e9b
`ed8ccaef52fa03fb03cff45b380f72c9f869f273`	affected	< 49cd5ac6de8de39a14ead609bb552d372d5602cd
`ed8ccaef52fa03fb03cff45b380f72c9f869f273`	affected	< 6e92b28cd74fa433658efeadf21b9d4b01023d7d
`ed8ccaef52fa03fb03cff45b380f72c9f869f273`	affected	< 277281c10c63791067d24d421f7c43a15faa9096

Linux

affected

Version	Status	Constraints
`4.3`	affected	—
`0`	unaffected	< 4.3
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[ed8ccaef52fa03fb03cff45b380f72c9f869f273,218c2836b3987f3fa1d9eac505462cded0821e4c)`	affected	code_commit	—
`[ed8ccaef52fa03fb03cff45b380f72c9f869f273,446b4d77599cf1a168573f7fb32a4a6aa4f09219)`	affected	code_commit	—
`[ed8ccaef52fa03fb03cff45b380f72c9f869f273,5d916c1eae1933511a69bffe243b4ee5d7da399c)`	affected	code_commit	—
`[ed8ccaef52fa03fb03cff45b380f72c9f869f273,f344a369d0380d54c8d6c8d24734a78dd5a89817)`	affected	code_commit	—
`[ed8ccaef52fa03fb03cff45b380f72c9f869f273,51144032248cc4ea22917370565650670b8b4e9b)`	affected	code_commit	—
`[ed8ccaef52fa03fb03cff45b380f72c9f869f273,49cd5ac6de8de39a14ead609bb552d372d5602cd)`	affected	code_commit	—
`[ed8ccaef52fa03fb03cff45b380f72c9f869f273,6e92b28cd74fa433658efeadf21b9d4b01023d7d)`	affected	code_commit	—
`[ed8ccaef52fa03fb03cff45b380f72c9f869f273,277281c10c63791067d24d421f7c43a15faa9096)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.3`	affected	generic	—
`[0,4.3)`	unaffected	generic	—
`[5.10.261,5.10.*]`	unaffected	generic	—
`[5.15.212,5.15.*]`	unaffected	generic	—
`[6.1.178,6.1.*]`	unaffected	generic	—
`[6.6.145,6.6.*]`	unaffected	generic	—
`[6.12.97,6.12.*]`	unaffected	generic	—
`[6.18.40,6.18.*]`	unaffected	generic	—
`[7.1.4,7.1.*]`	unaffected	generic	—
`[7.2-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to a kernel version that includes the patched intel_qat driver with the vf2pf_disabled flag and work‑queue drain logic.
Disable SR‑IOV for all QAT devices to eliminate the race while the kernel cannot be updated.
Unload or blacklist the intel_qat kernel module to stop the driver and its workqueue from running.
Reboot the system after making the change to clear any residual state.

Generated by OpenCVE AI on September 3, 2026 at 21:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4717-1	linux security update
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package
Debian DSA	DSA-6405-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00135.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/218c2836b3987f3fa1d9eac505462cded0821e4c
https://git.kernel.org/stable/c/277281c10c63791067d24d421f7c43a15faa9096
https://git.kernel.org/stable/c/446b4d77599cf1a168573f7fb32a4a6aa4f09219
https://git.kernel.org/stable/c/49cd5ac6de8de39a14ead609bb552d372d5602cd
https://git.kernel.org/stable/c/51144032248cc4ea22917370565650670b8b4e9b
https://git.kernel.org/stable/c/5d916c1eae1933511a69bffe243b4ee5d7da399c
https://git.kernel.org/stable/c/6e92b28cd74fa433658efeadf21b9d4b01023d7d
https://git.kernel.org/stable/c/f344a369d0380d54c8d6c8d24734a78dd5a89817
https://lore.kernel.org/linux-cve-announce/2026072538-CVE-2026-64438-13b5@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64438
https://www.cve.org/CVERecord?id=CVE-2026-64438

History

Thu, 03 Sep 2026 18:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Wed, 05 Aug 2026 01:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Mon, 03 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026072538-CVE-2026-64438-13b5@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64438 https://www.cve.org/CVERecord?id=CVE-2026-64438
Metrics	threat_severity `None`	threat_severity `Moderate`

Sun, 02 Aug 2026 13:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sat, 01 Aug 2026 02:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362 CWE-416

Mon, 27 Jul 2026 05:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-416

Mon, 27 Jul 2026 05:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}`

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() The VF2PF interrupt handler queues PF-side response work that stores a raw pointer to per-VF state (struct adf_accel_vf_info). Currently, adf_disable_sriov() destroys per-VF mutexes and frees vf_info without stopping new VF2PF work or waiting for in-flight workers to complete. A concurrently scheduled or already queued worker can then dereference freed memory. This manifests as a use-after-free when KASAN is enabled: BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0 Write of size 8 at addr 0000000000000260 by task kworker/24:2/... Workqueue: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat] Call Trace: kasan_report+0x119/0x140 mutex_lock+0x76/0xe0 adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat] adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat] adf_iov_send_resp+0x8c/0xe0 [intel_qat] process_one_work+0x6ac/0xfd0 worker_thread+0x4dd/0xd30 kthread+0x326/0x410 ret_from_fork+0x33b/0x670 Add a PF-local flag, vf2pf_disabled, that gates work queueing, worker processing, and interrupt re-enabling during teardown. Set this flag atomically with the hardware interrupt mask inside adf_disable_all_vf2pf_interrupts(). After masking, synchronize the AE cluster MSI-X interrupt and flush the PF response workqueue before tearing down per-VF locks and state so all in-flight work completes before vf_info is destroyed. Introduce adf_enable_all_vf2pf_interrupts() to clear the flag and unmask all VF2PF interrupts under the same lock when SR-IOV is re-enabled. This ensures the software flag and hardware state transition atomically on both the enable and disable paths.
Title		crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/218c2836b3987f3fa1d9eac505462cded0821e4c https://git.kernel.org/stable/c/277281c10c63791067d24d421f7c43a15faa9096 https://git.kernel.org/stable/c/446b4d77599cf1a168573f7fb32a4a6aa4f09219 https://git.kernel.org/stable/c/49cd5ac6de8de39a14ead609bb552d372d5602cd https://git.kernel.org/stable/c/51144032248cc4ea22917370565650670b8b4e9b https://git.kernel.org/stable/c/5d916c1eae1933511a69bffe243b4ee5d7da399c https://git.kernel.org/stable/c/6e92b28cd74fa433658efeadf21b9d4b01023d7d https://git.kernel.org/stable/c/f344a369d0380d54c8d6c8d24734a78dd5a89817

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:51:11.740Z

Updated: 2026-08-17T04:55:39.854Z

Reserved: 2026-07-19T15:36:31.788Z

Link: CVE-2026-64438

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-07-25T10:17:28.303

Modified: 2026-09-03T17:55:36.363

Link: CVE-2026-64438

Redhat

Severity : Moderate

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64438 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-03T22:00:13Z

Weaknesses

CWE-416
Use After Free
CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object