CVE-2026-64529

Received Received - Intake

QAT Driver Character Device and IOCTL Removal

Publication date: 2026-07-25

Last updated on: 2026-07-27

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - remove unused character device and IOCTLs The QAT driver exposes a character device (qat_adf_ctl) with IOCTLs for device configuration, start, stop, status query and enumeration. These IOCTLs are not part of any public uAPI header and have no known in-tree or out-of-tree users. Device lifecycle is already managed via sysfs. The ioctl interface also increases the attack surface and is the subject of a number of bug reports. Remove the character device, the IOCTL definitions, and the related data structures (adf_dev_status_info, adf_user_cfg_key_val, adf_user_cfg_section, adf_user_cfg_ctl_data). Drop the now-unused adf_cfg_user.h header and strip adf_ctl_drv.c down to the minimal module_init/module_exit hooks for workqueue, AER, and crypto/compression algorithm registration. Clean up leftover dead code that was only reachable from the removed IOCTL paths: adf_cfg_del_all(), adf_devmgr_verify_id(), adf_devmgr_get_num_dev(), adf_devmgr_get_dev_by_id(), adf_get_vf_real_id() and the unused ADF_CFG macros. Additionally, drop the entry associated to QAT IOCTLs in ioctl-number.rst.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-07-27

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64529

EUVD

EUVD-2026-49041

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves a security improvement in the Linux kernel where unused character device and IOCTL interfaces in the QAT (QuickAssist Technology) driver were removed. These interfaces were not part of any public API, had no known users, and increased the attack surface without providing functional value.

Detection Guidance

This vulnerability is not a traditional network or system exploit but rather a code cleanup in the Linux kernel's QAT driver. Detection involves checking if the affected QAT driver components are present. Use commands like 'lsmod | grep qat' to check if the QAT module is loaded, and 'find /lib/modules/$(uname -r) -name *qat*' to locate related files. If the module or files are found, the system may be using the vulnerable code.

Impact Analysis

This is not a vulnerability but a security cleanup. It reduces potential attack vectors by removing unused code that could have been exploited. Users of systems with QAT hardware may benefit from improved security and stability.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. The issue involves removal of unused IOCTLs and character device interfaces in the Linux kernel's QAT driver, which reduces attack surface but does not impact data protection or privacy controls required by these regulations.

Mitigation Strategies

Update the Linux kernel to a version that includes the fix for CVE-2026-64529. This removes the unused QAT driver components, reducing attack surface. If the QAT driver is not required, consider blacklisting the module using 'echo blacklist qat_adf_ctl >> /etc/modprobe.d/blacklist.conf' and rebooting.

Hi! I’m here to help you understand CVE-2026-64529. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70