CVE-2026-64438
Received Received - Intake

Use-After-Free in Intel QAT Driver Due to Race Condition

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() The VF2PF interrupt handler queues PF-side response work that stores a raw pointer to per-VF state (struct adf_accel_vf_info). Currently, adf_disable_sriov() destroys per-VF mutexes and frees vf_info without stopping new VF2PF work or waiting for in-flight workers to complete. A concurrently scheduled or already queued worker can then dereference freed memory. This manifests as a use-after-free when KASAN is enabled: BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0 Write of size 8 at addr 0000000000000260 by task kworker/24:2/... Workqueue: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat] Call Trace: kasan_report+0x119/0x140 mutex_lock+0x76/0xe0 adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat] adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat] adf_iov_send_resp+0x8c/0xe0 [intel_qat] process_one_work+0x6ac/0xfd0 worker_thread+0x4dd/0xd30 kthread+0x326/0x410 ret_from_fork+0x33b/0x670 Add a PF-local flag, vf2pf_disabled, that gates work queueing, worker processing, and interrupt re-enabling during teardown. Set this flag atomically with the hardware interrupt mask inside adf_disable_all_vf2pf_interrupts(). After masking, synchronize the AE cluster MSI-X interrupt and flush the PF response workqueue before tearing down per-VF locks and state so all in-flight work completes before vf_info is destroyed. Introduce adf_enable_all_vf2pf_interrupts() to clear the flag and unmask all VF2PF interrupts under the same lock when SR-IOV is re-enabled. This ensures the software flag and hardware state transition atomically on both the enable and disable paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64438
EUVD
EUVD-2026-48782

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
intel intel_qat *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's QuickAssist Technology (QAT) driver. It occurs when disabling SR-IOV in the qat driver. The issue involves a race condition where VF2PF interrupt handlers queue work that references freed memory. Specifically, adf_disable_sriov() destroys per-VF state without properly stopping or waiting for in-flight VF2PF work, leading to a null-pointer dereference when KASAN is enabled.

Detection Guidance

This vulnerability may manifest as a use-after-free error detected by KASAN, which logs kernel memory issues. Check kernel logs for KASAN reports or null-ptr-deref errors related to mutex_lock in the qat_pf2vf_resp_wq workqueue. Look for messages indicating crashes in intel_qat modules.

Impact Analysis

This vulnerability can cause system instability, crashes, or potential privilege escalation if exploited. Systems using Intel QAT with SR-IOV enabled may experience kernel panics or unexpected behavior when disabling SR-IOV. It primarily affects systems running affected versions of the Linux kernel with the intel_qat driver.

Mitigation Strategies

Apply the kernel patch that introduces the vf2pf_disabled flag and ensures proper synchronization during SR-IOV teardown. Update the intel_qat driver to the fixed version. Monitor kernel logs for any residual issues after applying the patch.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64438. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart