CVE-2026-64529 - Vulnerability Details

- crypto: qat - remove unused character device and IOCTLs

Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: qat - remove unused character device and IOCTLs

The QAT driver exposes a character device (qat_adf_ctl) with IOCTLs
for device configuration, start, stop, status query and enumeration.
These IOCTLs are not part of any public uAPI header and have no known
in-tree or out-of-tree users. Device lifecycle is already managed via
sysfs.

The ioctl interface also increases the attack surface and is the
subject of a number of bug reports.

Remove the character device, the IOCTL definitions, and the related
data structures (adf_dev_status_info, adf_user_cfg_key_val,
adf_user_cfg_section, adf_user_cfg_ctl_data). Drop the now-unused
adf_cfg_user.h header and strip adf_ctl_drv.c down to the minimal
module_init/module_exit hooks for workqueue, AER, and crypto/compression
algorithm registration.

Clean up leftover dead code that was only reachable from the removed
IOCTL paths: adf_cfg_del_all(), adf_devmgr_verify_id(),
adf_devmgr_get_num_dev(), adf_devmgr_get_dev_by_id(),
adf_get_vf_real_id() and the unused ADF_CFG macros.

Additionally, drop the entry associated to QAT IOCTLs in
ioctl-number.rst.

Published: 2026-07-25

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The QAT driver in the Linux kernel exposed a legacy character device (qat_adf_ctl) with several undocumented IOCTLs that were not part of the public API and had no known users. These unused interfaces expanded the kernel’s attack surface and introduced code paths that were only reachable via those IOCTLs. The vulnerability is mitigated by removing the character device, the IOCTL definitions, and associated structures, thereby eliminating the exposed functionality and associated dead code.

Affected Systems

The issue applies to any Linux kernel build that includes the QAT driver before the patches removing the legacy device and IOCTLs. Systems running kernels that load the qat module and expose the /dev/qat_adf_ctl device are affected until the code changes are applied.

Risk and Exploitability

The EPSS score is below 1% and the vulnerability is not listed in CISA KEV, indicating a low empirical exploitation probability at present. The CVSS score of 7.8 classifies the vulnerability as high severity. The IOCTL interface has no documented legitimate users and is not exposed via public APIs, so typical unprivileged usage is unlikely to trigger it. However, a process with root or sufficient kernel privileges could invoke these legacy IOCTLs if the obsolete device remains on a system not yet updated.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d8cba25d2c68992a6e7c1d329b690a9ebe01167d`	affected	< 071590a44cbc38483fceb1ab943363ec26868e1b
`d8cba25d2c68992a6e7c1d329b690a9ebe01167d`	affected	< 1de076f43e64bf65fbe7280a269c70e0e60518df
`d8cba25d2c68992a6e7c1d329b690a9ebe01167d`	affected	< a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a
`d8cba25d2c68992a6e7c1d329b690a9ebe01167d`	affected	< 6848a6e39cac44fdb7cb88f0f777df62172d1551
`d8cba25d2c68992a6e7c1d329b690a9ebe01167d`	affected	< b1ea97076bd0a5196290deba172034e480646727
`d8cba25d2c68992a6e7c1d329b690a9ebe01167d`	affected	< b8ebf008696de1ec08c90d51f94d7e40bd448be1
`d8cba25d2c68992a6e7c1d329b690a9ebe01167d`	affected	< de2cc38489b629927910b1aeff69bba7bd5c6f1b
`d8cba25d2c68992a6e7c1d329b690a9ebe01167d`	affected	< 3ae49dd04dbb11fb73f17f58a982dba128abe83a
`d8cba25d2c68992a6e7c1d329b690a9ebe01167d`	affected	< d237230728c567297f2f98b425d63156ab2ed17f

Linux

affected

Version	Status	Constraints
`3.17`	affected	—
`0`	unaffected	< 3.17
`5.10.260`	unaffected	≤ 5.10.*
`5.15.211`	unaffected	≤ 5.15.*
`6.1.177`	unaffected	≤ 6.1.*
`6.6.144`	unaffected	≤ 6.6.*
`6.12.95`	unaffected	≤ 6.12.*
`6.18.37`	unaffected	≤ 6.18.*
`7.0.14`	unaffected	≤ 7.0.*
`7.1.2`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[d8cba25d2c68992a6e7c1d329b690a9ebe01167d,071590a44cbc38483fceb1ab943363ec26868e1b)`	affected	code_commit	—
`[d8cba25d2c68992a6e7c1d329b690a9ebe01167d,1de076f43e64bf65fbe7280a269c70e0e60518df)`	affected	code_commit	—
`[d8cba25d2c68992a6e7c1d329b690a9ebe01167d,a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a)`	affected	code_commit	—
`[d8cba25d2c68992a6e7c1d329b690a9ebe01167d,6848a6e39cac44fdb7cb88f0f777df62172d1551)`	affected	code_commit	—
`[d8cba25d2c68992a6e7c1d329b690a9ebe01167d,b1ea97076bd0a5196290deba172034e480646727)`	affected	code_commit	—
`[d8cba25d2c68992a6e7c1d329b690a9ebe01167d,b8ebf008696de1ec08c90d51f94d7e40bd448be1)`	affected	code_commit	—
`[d8cba25d2c68992a6e7c1d329b690a9ebe01167d,d237230728c567297f2f98b425d63156ab2ed17f)`	affected	code_commit	—
`[d8cba25d2c68992a6e7c1d329b690a9ebe01167d,3ae49dd04dbb11fb73f17f58a982dba128abe83a)`	affected	code_commit	—
`[d8cba25d2c68992a6e7c1d329b690a9ebe01167d,de2cc38489b629927910b1aeff69bba7bd5c6f1b)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.17`	affected	generic	—
`[0,3.17)`	unaffected	generic	—
`[5.10.260,5.11.0)`	unaffected	semver	—
`[5.15.211,5.16.0)`	unaffected	semver	—
`[6.1.177,6.2.0)`	unaffected	semver	—
`[6.6.144,6.7.0)`	unaffected	semver	—
`[6.12.95,6.13.0)`	unaffected	semver	—
`[6.18.37,6.19.0)`	unaffected	semver	—
`[7.0.14,7.1.0)`	unaffected	semver	—
`[7.1.2,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the kernel to a version that includes the QAT driver changes removing the unused character device and IOCTLs.
If the system relies on the qat module but cannot apply the patch immediately, disable the module by removing it with "modprobe -r qat" or by preventing its automatic loading via module configuration.
Monitor system logs for any attempts to access or interact with the obsolete /dev/qat_adf_ctl device or related ioctl operations.

Generated by OpenCVE AI on October 20, 2026 at 09:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4700-1	linux-6.1 security update
Debian DLA	DLA-4717-1	linux security update
Ubuntu USN	USN-8726-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8727-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8760-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8726-2	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8781-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8726-3	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8800-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8760-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8726-4	Linux kernel vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8875-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8877-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8875-2	Linux kernel (NVIDIA) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00184.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/071590a44cbc38483fceb1ab943363ec26868e1b
https://git.kernel.org/stable/c/1de076f43e64bf65fbe7280a269c70e0e60518df
https://git.kernel.org/stable/c/3ae49dd04dbb11fb73f17f58a982dba128abe83a
https://git.kernel.org/stable/c/6848a6e39cac44fdb7cb88f0f777df62172d1551
https://git.kernel.org/stable/c/a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a
https://git.kernel.org/stable/c/b1ea97076bd0a5196290deba172034e480646727
https://git.kernel.org/stable/c/b8ebf008696de1ec08c90d51f94d7e40bd448be1
https://git.kernel.org/stable/c/d237230728c567297f2f98b425d63156ab2ed17f
https://git.kernel.org/stable/c/de2cc38489b629927910b1aeff69bba7bd5c6f1b
https://lore.kernel.org/linux-cve-announce/2026072500-CVE-2026-64529-04eb@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64529
https://www.cve.org/CVERecord?id=CVE-2026-64529

History

Mon, 19 Oct 2026 21:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-489

Fri, 16 Oct 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 30 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-749
References		https://lore.kernel.org/linux-cve-announce/2026072500-CVE-2026-64529-04eb@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64529 https://www.cve.org/CVERecord?id=CVE-2026-64529
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 27 Jul 2026 05:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 25 Jul 2026 10:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: crypto: qat - remove unused character device and IOCTLs The QAT driver exposes a character device (qat_adf_ctl) with IOCTLs for device configuration, start, stop, status query and enumeration. These IOCTLs are not part of any public uAPI header and have no known in-tree or out-of-tree users. Device lifecycle is already managed via sysfs. The ioctl interface also increases the attack surface and is the subject of a number of bug reports. Remove the character device, the IOCTL definitions, and the related data structures (adf_dev_status_info, adf_user_cfg_key_val, adf_user_cfg_section, adf_user_cfg_ctl_data). Drop the now-unused adf_cfg_user.h header and strip adf_ctl_drv.c down to the minimal module_init/module_exit hooks for workqueue, AER, and crypto/compression algorithm registration. Clean up leftover dead code that was only reachable from the removed IOCTL paths: adf_cfg_del_all(), adf_devmgr_verify_id(), adf_devmgr_get_num_dev(), adf_devmgr_get_dev_by_id(), adf_get_vf_real_id() and the unused ADF_CFG macros. Additionally, drop the entry associated to QAT IOCTLs in ioctl-number.rst.
Title		crypto: qat - remove unused character device and IOCTLs
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/071590a44cbc38483fceb1ab943363ec26868e1b https://git.kernel.org/stable/c/1de076f43e64bf65fbe7280a269c70e0e60518df https://git.kernel.org/stable/c/3ae49dd04dbb11fb73f17f58a982dba128abe83a https://git.kernel.org/stable/c/6848a6e39cac44fdb7cb88f0f777df62172d1551 https://git.kernel.org/stable/c/a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a https://git.kernel.org/stable/c/b1ea97076bd0a5196290deba172034e480646727 https://git.kernel.org/stable/c/b8ebf008696de1ec08c90d51f94d7e40bd448be1 https://git.kernel.org/stable/c/d237230728c567297f2f98b425d63156ab2ed17f https://git.kernel.org/stable/c/de2cc38489b629927910b1aeff69bba7bd5c6f1b

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T09:24:18.750Z

Updated: 2026-10-19T20:48:38.158Z

Reserved: 2026-07-19T15:36:31.794Z

Link: CVE-2026-64529

Vulnrichment

Updated: 2026-10-16T15:41:42.541Z

NVD

Status : Awaiting Analysis

Published: 2026-07-25T10:17:39.317

Modified: 2026-11-03T18:15:39.353

Link: CVE-2026-64529

Redhat

Severity : Moderate

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64529 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-20T10:00:14Z

Weaknesses

CWE-489
Active Debug Code
CWE-749
Exposed Dangerous Method or Function

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object