The vulnerability originates from a race condition in the vfio/qat driver’s qat_vf_resume_write() function. Two concurrent writers may each read the file position before obtaining the migration‑state lock, then both copy data after the lock is taken, causing an out‑of‑bounds write into the migration‑state buffer. This memory corruption can overwrite kernel structures, potentially leading to a crash or enabling an attacker to execute code in kernel mode. The flaw is a classic buffer overflow triggered by write operations that the driver fails to guard against.

The defect resides exclusively in the Linux kernel’s vfio/qat driver. No specific kernel release numbers are listed in the advisory, so every kernel version that ships the vulnerable driver segment is potentially affected until a patched version is deployed. The affected fabric is all Linux distributions running the susceptible Linux kernel with the vfio/qat module active.

The CVSS score of 7.8 indicates a moderate‑to‑high severity for local privilege escalation. The EPSS score of <1% suggests a very low probability of exploitation but is not zero, implying that while the vulnerability is not widely seized by attackers yet, it remains a relevant concern in environments where many users can access the QAT device. The flaw is not listed in CISA’s KEV catalog, so no active exploit advisories are known. In practice, an attacker who can orchestrate concurrent writes to the QAT interface could trigger the race, leading to kernel memory corruption and potentially arbitrary code execution as the kernel. The likely attack vector is concurrent writes, which an attacker can generate if they have write permissions on the QAT device.