CVE-2026-64438

Analyzed Analyzed - Analysis Complete

Use-After-Free in Intel QAT Driver Due to Race Condition

Publication date: 2026-07-25

Last updated on: 2026-09-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() The VF2PF interrupt handler queues PF-side response work that stores a raw pointer to per-VF state (struct adf_accel_vf_info). Currently, adf_disable_sriov() destroys per-VF mutexes and frees vf_info without stopping new VF2PF work or waiting for in-flight workers to complete. A concurrently scheduled or already queued worker can then dereference freed memory. This manifests as a use-after-free when KASAN is enabled: BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0 Write of size 8 at addr 0000000000000260 by task kworker/24:2/... Workqueue: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat] Call Trace: kasan_report+0x119/0x140 mutex_lock+0x76/0xe0 adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat] adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat] adf_iov_send_resp+0x8c/0xe0 [intel_qat] process_one_work+0x6ac/0xfd0 worker_thread+0x4dd/0xd30 kthread+0x326/0x410 ret_from_fork+0x33b/0x670 Add a PF-local flag, vf2pf_disabled, that gates work queueing, worker processing, and interrupt re-enabling during teardown. Set this flag atomically with the hardware interrupt mask inside adf_disable_all_vf2pf_interrupts(). After masking, synchronize the AE cluster MSI-X interrupt and flush the PF response workqueue before tearing down per-VF locks and state so all in-flight work completes before vf_info is destroyed. Introduce adf_enable_all_vf2pf_interrupts() to clear the flag and unmask all VF2PF interrupts under the same lock when SR-IOV is re-enabled. This ensures the software flag and hardware state transition atomically on both the enable and disable paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-03

Generated

2026-09-23

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-22

NVD

CVE-2026-64438

EUVD

EUVD-2026-48782

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 5.11 (inc) to 5.15.212 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.178 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.145 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.40 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.97 (exc)
linux	linux_kernel	From 4.3 (inc) to 5.10.261 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's QuickAssist Technology (QAT) driver. It occurs when disabling SR-IOV in the qat driver. The issue involves a race condition where VF2PF interrupt handlers queue work that references freed memory. Specifically, adf_disable_sriov() destroys per-VF state without properly stopping or waiting for in-flight VF2PF work, leading to a null-pointer dereference when KASAN is enabled.

Detection Guidance

This vulnerability may manifest as a use-after-free error detected by KASAN, which logs kernel memory issues. Check kernel logs for KASAN reports or null-ptr-deref errors related to mutex_lock in the qat_pf2vf_resp_wq workqueue. Look for messages indicating crashes in intel_qat modules.

Impact Analysis

This vulnerability can cause system instability, crashes, or potential privilege escalation if exploited. Systems using Intel QAT with SR-IOV enabled may experience kernel panics or unexpected behavior when disabling SR-IOV. It primarily affects systems running affected versions of the Linux kernel with the intel_qat driver.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's crypto QAT driver that could lead to memory corruption or crashes. It does not directly relate to data protection or privacy compliance standards like GDPR or HIPAA, which focus on unauthorized data access or breaches. The impact is primarily on system stability and security integrity rather than regulatory compliance.

Mitigation Strategies

Apply the kernel patch that introduces the vf2pf_disabled flag and ensures proper synchronization during SR-IOV teardown. Update the intel_qat driver to the fixed version. Monitor kernel logs for any residual issues after applying the patch.

Hi! I’m here to help you understand CVE-2026-64438. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70