CVE-2026-64305

Analyzed Analyzed - Analysis Complete

Race Condition in Linux Kernel Crypto QAT Driver

Publication date: 2026-07-25

Last updated on: 2026-09-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - protect service table iterations with service_lock The service_table list is protected by service_lock when entries are added or removed (in adf_service_add() and adf_service_remove()), but several functions iterate over the list without holding this lock. A concurrent adf_service_register() or adf_service_unregister() call could modify the list during traversal, leading to list corruption or a use-after-free. Fix this by holding service_lock across all list_for_each_entry() iterations of service_table in adf_dev_init(), adf_dev_start(), adf_dev_stop(), adf_dev_shutdown(), adf_dev_restarting_notify(), adf_dev_restarted_notify(), and adf_error_notifier(). The lock ordering is safe: callers of the static helpers (adf_dev_up() and adf_dev_down()) acquire state_lock before service_lock, and no event_hld callback or service_lock holder ever acquires state_lock in the reverse order.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-03

Generated

2026-09-03

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-02

NVD

CVE-2026-64305

EUVD

EUVD-2026-49017

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	From 3.17 (inc) to 6.12.96 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where the service_table list is accessed without proper locking. The service_lock protects list modifications, but several functions iterate over the list without holding this lock. A concurrent registration or unregistration could corrupt the list or cause a use-after-free.

Detection Guidance

This vulnerability is specific to the Linux kernel's crypto QAT driver and requires kernel-level inspection. Detection involves checking for kernel logs or crashes related to list corruption or use-after-free in QAT services. Commands like dmesg | grep qat or journalctl -k | grep qat may help identify issues. Ensure your kernel is updated to a patched version.

Impact Analysis

This could lead to system crashes, data corruption, or privilege escalation if exploited. Attackers might trigger list corruption or use-after-free conditions to execute arbitrary code or cause denial of service.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a memory corruption issue in the Linux kernel's crypto subsystem. However, if exploited, it could lead to system instability or crashes, potentially causing data loss or unauthorized access, which may indirectly impact compliance.

Mitigation Strategies

Apply the latest kernel update from your distribution to patch the QAT driver vulnerability. If immediate patching is not possible, disable the QAT driver by blacklisting the module (e.g., echo blacklist qat_c62x >> /etc/modprobe.d/disable-qat.conf) and reboot. Monitor system logs for signs of exploitation or crashes.

Hi! I’m here to help you understand CVE-2026-64305. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70