CVE-2026-64529 - Vulnerability Details

- crypto: qat - remove unused character device and IOCTLs

Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: qat - remove unused character device and IOCTLs

The QAT driver exposes a character device (qat_adf_ctl) with IOCTLs
for device configuration, start, stop, status query and enumeration.
These IOCTLs are not part of any public uAPI header and have no known
in-tree or out-of-tree users. Device lifecycle is already managed via
sysfs.

The ioctl interface also increases the attack surface and is the
subject of a number of bug reports.

Remove the character device, the IOCTL definitions, and the related
data structures (adf_dev_status_info, adf_user_cfg_key_val,
adf_user_cfg_section, adf_user_cfg_ctl_data). Drop the now-unused
adf_cfg_user.h header and strip adf_ctl_drv.c down to the minimal
module_init/module_exit hooks for workqueue, AER, and crypto/compression
algorithm registration.

Clean up leftover dead code that was only reachable from the removed
IOCTL paths: adf_cfg_del_all(), adf_devmgr_verify_id(),
adf_devmgr_get_num_dev(), adf_devmgr_get_dev_by_id(),
adf_get_vf_real_id() and the unused ADF_CFG macros.

Additionally, drop the entry associated to QAT IOCTLs in
ioctl-number.rst.

Published: 2026-07-25

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel QAT driver exposed a character device (qat_adf_ctl) with several undocumented IOCTLs that were not part of the public API and had no known users. Retaining these unused interfaces expands the kernel’s attack surface; the associated code paths were reachable only via those IOCTLs. The vulnerability is addressed by removing the character device, the IOCTL definitions, and the related data structures. The assigned CVSS score of 7.8 indicates a high severity, reflecting the potential impact of malicious control over driver operations, even though no exploitation has been reported.

Affected Systems

The issue applies to Linux kernel builds that include the QAT driver prior to the applied fixes (commits 071590a44cbc38483fceb1ab943363ec26868e1b, 1de076f43e64bf65fbe7280a269c70e0e60518df, and others). Systems running any kernel version that loads the qat module and that exposed the legacy /dev/qat_adf_ctl device are affected until the patch is applied.

Risk and Exploitability

The EPSS score is below 1% and the vulnerability is not listed in CISA KEV, indicating a low empirical exploitation probability at the moment. Because the IOCTL interface has no documented legitimate users and is not exposed via public APIs, typical unprivileged usage is unlikely to trigger it. However, any process with root or sufficient kernel privileges could theoretically invoke these IOCTLs if the legacy device were present in a system that had not yet been updated.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d8cba25d2c68992a6e7c1d329b690a9ebe01167d`	affected	< 071590a44cbc38483fceb1ab943363ec26868e1b
`d8cba25d2c68992a6e7c1d329b690a9ebe01167d`	affected	< 1de076f43e64bf65fbe7280a269c70e0e60518df
`d8cba25d2c68992a6e7c1d329b690a9ebe01167d`	affected	< a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a
`d8cba25d2c68992a6e7c1d329b690a9ebe01167d`	affected	< 6848a6e39cac44fdb7cb88f0f777df62172d1551
`d8cba25d2c68992a6e7c1d329b690a9ebe01167d`	affected	< b1ea97076bd0a5196290deba172034e480646727
`d8cba25d2c68992a6e7c1d329b690a9ebe01167d`	affected	< b8ebf008696de1ec08c90d51f94d7e40bd448be1
`d8cba25d2c68992a6e7c1d329b690a9ebe01167d`	affected	< de2cc38489b629927910b1aeff69bba7bd5c6f1b
`d8cba25d2c68992a6e7c1d329b690a9ebe01167d`	affected	< 3ae49dd04dbb11fb73f17f58a982dba128abe83a
`d8cba25d2c68992a6e7c1d329b690a9ebe01167d`	affected	< d237230728c567297f2f98b425d63156ab2ed17f

Linux

affected

Version	Status	Constraints
`3.17`	affected	—
`0`	unaffected	< 3.17
`5.10.260`	unaffected	≤ 5.10.*
`5.15.211`	unaffected	≤ 5.15.*
`6.1.177`	unaffected	≤ 6.1.*
`6.6.144`	unaffected	≤ 6.6.*
`6.12.95`	unaffected	≤ 6.12.*
`6.18.37`	unaffected	≤ 6.18.*
`7.0.14`	unaffected	≤ 7.0.*
`7.1.2`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[d8cba25d2c68992a6e7c1d329b690a9ebe01167d,071590a44cbc38483fceb1ab943363ec26868e1b)`	affected	code_commit	—
`[d8cba25d2c68992a6e7c1d329b690a9ebe01167d,1de076f43e64bf65fbe7280a269c70e0e60518df)`	affected	code_commit	—
`[d8cba25d2c68992a6e7c1d329b690a9ebe01167d,a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a)`	affected	code_commit	—
`[d8cba25d2c68992a6e7c1d329b690a9ebe01167d,6848a6e39cac44fdb7cb88f0f777df62172d1551)`	affected	code_commit	—
`[d8cba25d2c68992a6e7c1d329b690a9ebe01167d,b1ea97076bd0a5196290deba172034e480646727)`	affected	code_commit	—
`[d8cba25d2c68992a6e7c1d329b690a9ebe01167d,b8ebf008696de1ec08c90d51f94d7e40bd448be1)`	affected	code_commit	—
`[d8cba25d2c68992a6e7c1d329b690a9ebe01167d,d237230728c567297f2f98b425d63156ab2ed17f)`	affected	code_commit	—
`[d8cba25d2c68992a6e7c1d329b690a9ebe01167d,3ae49dd04dbb11fb73f17f58a982dba128abe83a)`	affected	code_commit	—
`[d8cba25d2c68992a6e7c1d329b690a9ebe01167d,de2cc38489b629927910b1aeff69bba7bd5c6f1b)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.17`	affected	generic	—
`[0,3.17)`	unaffected	generic	—
`[5.10.260,5.11.0)`	unaffected	semver	—
`[5.15.211,5.16.0)`	unaffected	semver	—
`[6.1.177,6.2.0)`	unaffected	semver	—
`[6.6.144,6.7.0)`	unaffected	semver	—
`[6.12.95,6.13.0)`	unaffected	semver	—
`[6.18.37,6.19.0)`	unaffected	semver	—
`[7.0.14,7.1.0)`	unaffected	semver	—
`[7.1.2,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the kernel to a version that includes the QAT driver changes removing the unused character device and IOCTLs.
If the system relies on the qat module but cannot apply the patch immediately, disable the module by removing it with "modprobe -r qat" or by preventing automatic loading via module configuration.
Monitor system logs for any attempts to access or interact with the obsolete /dev/qat_adf_ctl device or related ioctl operations.

Generated by OpenCVE AI on August 2, 2026 at 12:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4700-1	linux-6.1 security update
Debian DLA	DLA-4717-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00135.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/071590a44cbc38483fceb1ab943363ec26868e1b
https://git.kernel.org/stable/c/1de076f43e64bf65fbe7280a269c70e0e60518df
https://git.kernel.org/stable/c/3ae49dd04dbb11fb73f17f58a982dba128abe83a
https://git.kernel.org/stable/c/6848a6e39cac44fdb7cb88f0f777df62172d1551
https://git.kernel.org/stable/c/a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a
https://git.kernel.org/stable/c/b1ea97076bd0a5196290deba172034e480646727
https://git.kernel.org/stable/c/b8ebf008696de1ec08c90d51f94d7e40bd448be1
https://git.kernel.org/stable/c/d237230728c567297f2f98b425d63156ab2ed17f
https://git.kernel.org/stable/c/de2cc38489b629927910b1aeff69bba7bd5c6f1b
https://lore.kernel.org/linux-cve-announce/2026072500-CVE-2026-64529-04eb@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64529
https://www.cve.org/CVERecord?id=CVE-2026-64529

History

Thu, 30 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-749
References		https://lore.kernel.org/linux-cve-announce/2026072500-CVE-2026-64529-04eb@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64529 https://www.cve.org/CVERecord?id=CVE-2026-64529
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 27 Jul 2026 05:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 25 Jul 2026 10:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: crypto: qat - remove unused character device and IOCTLs The QAT driver exposes a character device (qat_adf_ctl) with IOCTLs for device configuration, start, stop, status query and enumeration. These IOCTLs are not part of any public uAPI header and have no known in-tree or out-of-tree users. Device lifecycle is already managed via sysfs. The ioctl interface also increases the attack surface and is the subject of a number of bug reports. Remove the character device, the IOCTL definitions, and the related data structures (adf_dev_status_info, adf_user_cfg_key_val, adf_user_cfg_section, adf_user_cfg_ctl_data). Drop the now-unused adf_cfg_user.h header and strip adf_ctl_drv.c down to the minimal module_init/module_exit hooks for workqueue, AER, and crypto/compression algorithm registration. Clean up leftover dead code that was only reachable from the removed IOCTL paths: adf_cfg_del_all(), adf_devmgr_verify_id(), adf_devmgr_get_num_dev(), adf_devmgr_get_dev_by_id(), adf_get_vf_real_id() and the unused ADF_CFG macros. Additionally, drop the entry associated to QAT IOCTLs in ioctl-number.rst.
Title		crypto: qat - remove unused character device and IOCTLs
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/071590a44cbc38483fceb1ab943363ec26868e1b https://git.kernel.org/stable/c/1de076f43e64bf65fbe7280a269c70e0e60518df https://git.kernel.org/stable/c/3ae49dd04dbb11fb73f17f58a982dba128abe83a https://git.kernel.org/stable/c/6848a6e39cac44fdb7cb88f0f777df62172d1551 https://git.kernel.org/stable/c/a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a https://git.kernel.org/stable/c/b1ea97076bd0a5196290deba172034e480646727 https://git.kernel.org/stable/c/b8ebf008696de1ec08c90d51f94d7e40bd448be1 https://git.kernel.org/stable/c/d237230728c567297f2f98b425d63156ab2ed17f https://git.kernel.org/stable/c/de2cc38489b629927910b1aeff69bba7bd5c6f1b

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T09:24:18.750Z

Updated: 2026-08-05T12:42:38.819Z

Reserved: 2026-07-19T15:36:31.794Z

Link: CVE-2026-64529

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-07-25T10:17:39.317

Modified: 2026-07-27T05:16:56.580

Link: CVE-2026-64529

Redhat

Severity : Moderate

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64529 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-02T12:15:18Z

Weaknesses

CWE-749
Exposed Dangerous Method or Function

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object