Vulnerability-Lookup

FKIE_CVE-2026-64438

Vulnerability from fkie_nvd - Published: 2026-07-25 10:17 - Updated: 2026-10-24 13:10

Severity

8.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() The VF2PF interrupt handler queues PF-side response work that stores a raw pointer to per-VF state (struct adf_accel_vf_info). Currently, adf_disable_sriov() destroys per-VF mutexes and frees vf_info without stopping new VF2PF work or waiting for in-flight workers to complete. A concurrently scheduled or already queued worker can then dereference freed memory. This manifests as a use-after-free when KASAN is enabled: BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0 Write of size 8 at addr 0000000000000260 by task kworker/24:2/... Workqueue: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat] Call Trace: kasan_report+0x119/0x140 mutex_lock+0x76/0xe0 adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat] adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat] adf_iov_send_resp+0x8c/0xe0 [intel_qat] process_one_work+0x6ac/0xfd0 worker_thread+0x4dd/0xd30 kthread+0x326/0x410 ret_from_fork+0x33b/0x670 Add a PF-local flag, vf2pf_disabled, that gates work queueing, worker processing, and interrupt re-enabling during teardown. Set this flag atomically with the hardware interrupt mask inside adf_disable_all_vf2pf_interrupts(). After masking, synchronize the AE cluster MSI-X interrupt and flush the PF response workqueue before tearing down per-VF locks and state so all in-flight work completes before vf_info is destroyed. Introduce adf_enable_all_vf2pf_interrupts() to clear the flag and unmask all VF2PF interrupts under the same lock when SR-IOV is re-enabled. This ensures the software flag and hardware state transition atomically on both the enable and disable paths.

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/218c2836b3987f3fa1d9eac505462cded0821e4c	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/277281c10c63791067d24d421f7c43a15faa9096	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/446b4d77599cf1a168573f7fb32a4a6aa4f09219	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/49cd5ac6de8de39a14ead609bb552d372d5602cd	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/51144032248cc4ea22917370565650670b8b4e9b	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/5d916c1eae1933511a69bffe243b4ee5d7da399c	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/6e92b28cd74fa433658efeadf21b9d4b01023d7d	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/f344a369d0380d54c8d6c8d24734a78dd5a89817	Patch

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/intel/qat/qat_common/adf_accel_devices.h",
            "drivers/crypto/intel/qat/qat_common/adf_common_drv.h",
            "drivers/crypto/intel/qat/qat_common/adf_isr.c",
            "drivers/crypto/intel/qat/qat_common/adf_sriov.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "218c2836b3987f3fa1d9eac505462cded0821e4c",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            },
            {
              "lessThan": "446b4d77599cf1a168573f7fb32a4a6aa4f09219",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            },
            {
              "lessThan": "5d916c1eae1933511a69bffe243b4ee5d7da399c",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            },
            {
              "lessThan": "f344a369d0380d54c8d6c8d24734a78dd5a89817",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            },
            {
              "lessThan": "51144032248cc4ea22917370565650670b8b4e9b",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            },
            {
              "lessThan": "49cd5ac6de8de39a14ead609bb552d372d5602cd",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            },
            {
              "lessThan": "6e92b28cd74fa433658efeadf21b9d4b01023d7d",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            },
            {
              "lessThan": "277281c10c63791067d24d421f7c43a15faa9096",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/intel/qat/qat_common/adf_accel_devices.h",
            "drivers/crypto/intel/qat/qat_common/adf_common_drv.h",
            "drivers/crypto/intel/qat/qat_common/adf_isr.c",
            "drivers/crypto/intel/qat/qat_common/adf_sriov.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.3"
            },
            {
              "lessThan": "4.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "797E695E-C99E-4F7E-AC6C-38D5378E6A9B",
              "versionEndExcluding": "5.10.261",
              "versionStartIncluding": "4.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8E99FB01-CD93-41AF-A653-3F450652B9A6",
              "versionEndExcluding": "5.15.212",
              "versionStartIncluding": "5.11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "092233C7-F4E0-40C8-BD4D-A28FE50DFE20",
              "versionEndExcluding": "6.1.178",
              "versionStartIncluding": "5.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7046B092-F810-4440-ACE6-60218518EECE",
              "versionEndExcluding": "6.6.145",
              "versionStartIncluding": "6.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "05880CF6-5AD2-44E9-853A-6CE8318E76A5",
              "versionEndExcluding": "6.12.97",
              "versionStartIncluding": "6.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "67D87928-1419-4529-9201-42C059678CB4",
              "versionEndExcluding": "6.18.40",
              "versionStartIncluding": "6.13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42",
              "versionEndExcluding": "7.1.4",
              "versionStartIncluding": "6.19",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - fix VF2PF work teardown race in adf_disable_sriov()\n\nThe VF2PF interrupt handler queues PF-side response work that stores a\nraw pointer to per-VF state (struct adf_accel_vf_info). Currently,\nadf_disable_sriov() destroys per-VF mutexes and frees vf_info without\nstopping new VF2PF work or waiting for in-flight workers to complete. A\nconcurrently scheduled or already queued worker can then dereference\nfreed memory.\n\nThis manifests as a use-after-free when KASAN is enabled:\n\n  BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0\n  Write of size 8 at addr 0000000000000260 by task kworker/24:2/...\n  Workqueue: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat]\n  Call Trace:\n    kasan_report+0x119/0x140\n    mutex_lock+0x76/0xe0\n    adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat]\n    adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat]\n    adf_iov_send_resp+0x8c/0xe0 [intel_qat]\n    process_one_work+0x6ac/0xfd0\n    worker_thread+0x4dd/0xd30\n    kthread+0x326/0x410\n    ret_from_fork+0x33b/0x670\n\nAdd a PF-local flag, vf2pf_disabled, that gates work queueing, worker\nprocessing, and interrupt re-enabling during teardown. Set this flag\natomically with the hardware interrupt mask inside\nadf_disable_all_vf2pf_interrupts(). After masking, synchronize the AE\ncluster MSI-X interrupt and flush the PF response workqueue before\ntearing down per-VF locks and state so all in-flight work completes\nbefore vf_info is destroyed.\n\nIntroduce adf_enable_all_vf2pf_interrupts() to clear the flag and\nunmask all VF2PF interrupts under the same lock when SR-IOV is\nre-enabled. This ensures the software flag and hardware state transition\natomically on both the enable and disable paths."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncrypto: qat - correcci\u00f3n de la condici\u00f3n de carrera en la deshabilitaci\u00f3n del trabajo VF2PF en adf_disable_sriov()\n\nEl gestor de interrupciones VF2PF encola trabajo de respuesta del lado del PF que almacena un puntero sin procesar al estado por VF (struct adf_accel_vf_info). Actualmente, adf_disable_sriov() destruye los mutexes por VF y libera vf_info sin detener nuevo trabajo VF2PF o esperar a que los trabajadores en curso se completen. Un trabajador programado concurrentemente o ya encolado puede entonces desreferenciar memoria liberada.\n\nEsto se manifiesta como un uso despu\u00e9s de liberaci\u00f3n cuando KASAN est\u00e1 habilitado:\n\n  ERROR: KASAN: null-ptr-deref en mutex_lock+0x76/0xe0\n  Escritura de tama\u00f1o 8 en la direcci\u00f3n 0000000000000260 por la tarea kworker/24:2/...\n  Cola de trabajo: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat]\n  Rastro de Llamada:\n    kasan_report+0x119/0x140\n    mutex_lock+0x76/0xe0\n    adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat]\n    adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat]\n    adf_iov_send_resp+0x8c/0xe0 [intel_qat]\n    process_one_work+0x6ac/0xfd0\n    worker_thread+0x4dd/0xd30\n    kthread+0x326/0x410\n    ret_from_fork+0x33b/0x670\n\nSe a\u00f1ade un indicador local de PF, vf2pf_disabled, que controla el encolamiento de trabajo, el procesamiento de trabajadores y la re-habilitaci\u00f3n de interrupciones durante la deshabilitaci\u00f3n. Este indicador se establece at\u00f3micamente con la m\u00e1scara de interrupci\u00f3n de hardware dentro de adf_disable_all_vf2pf_interrupts(). Despu\u00e9s de enmascarar, se sincroniza la interrupci\u00f3n MSI-X del cl\u00faster AE y se vac\u00eda la cola de trabajo de respuesta del PF antes de deshabilitar los bloqueos y el estado por VF para que todo el trabajo en curso se complete antes de que vf_info sea destruido.\n\nSe introduce adf_enable_all_vf2pf_interrupts() para borrar el indicador y desenmascarar todas las interrupciones VF2PF bajo el mismo bloqueo cuando SR-IOV es re-habilitado. Esto asegura que el indicador de software y el estado del hardware transicionen at\u00f3micamente tanto en las rutas de habilitaci\u00f3n como de deshabilitaci\u00f3n."
    }
  ],
  "id": "CVE-2026-64438",
  "lastModified": "2026-10-24T13:10:00.147",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 6.0,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-64438",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-16T15:40:43.590817Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-25T10:17:28.303",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/218c2836b3987f3fa1d9eac505462cded0821e4c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/277281c10c63791067d24d421f7c43a15faa9096"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/446b4d77599cf1a168573f7fb32a4a6aa4f09219"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/49cd5ac6de8de39a14ead609bb552d372d5602cd"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/51144032248cc4ea22917370565650670b8b4e9b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/5d916c1eae1933511a69bffe243b4ee5d7da399c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/6e92b28cd74fa433658efeadf21b9d4b01023d7d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/f344a369d0380d54c8d6c8d24734a78dd5a89817"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

CVE-2026-64438 (GCVE-0-2026-64438)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-10-19 20:38

Title

crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()

Summary

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:40 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6639 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/218c2836b3987f3fa…
https://git.kernel.org/stable/c/446b4d77599cf1a16…
https://git.kernel.org/stable/c/5d916c1eae1933511…
https://git.kernel.org/stable/c/f344a369d0380d54c…
https://git.kernel.org/stable/c/51144032248cc4ea2…
https://git.kernel.org/stable/c/49cd5ac6de8de39a1…
https://git.kernel.org/stable/c/6e92b28cd74fa4336…
https://git.kernel.org/stable/c/277281c10c6379106…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: ed8ccaef52fa03fb03cff45b380f72c9f869f273 , < 218c2836b3987f3fa1d9eac505462cded0821e4c (git) Affected: ed8ccaef52fa03fb03cff45b380f72c9f869f273 , < 446b4d77599cf1a168573f7fb32a4a6aa4f09219 (git) Affected: ed8ccaef52fa03fb03cff45b380f72c9f869f273 , < 5d916c1eae1933511a69bffe243b4ee5d7da399c (git) Affected: ed8ccaef52fa03fb03cff45b380f72c9f869f273 , < f344a369d0380d54c8d6c8d24734a78dd5a89817 (git) Affected: ed8ccaef52fa03fb03cff45b380f72c9f869f273 , < 51144032248cc4ea22917370565650670b8b4e9b (git) Affected: ed8ccaef52fa03fb03cff45b380f72c9f869f273 , < 49cd5ac6de8de39a14ead609bb552d372d5602cd (git) Affected: ed8ccaef52fa03fb03cff45b380f72c9f869f273 , < 6e92b28cd74fa433658efeadf21b9d4b01023d7d (git) Affected: ed8ccaef52fa03fb03cff45b380f72c9f869f273 , < 277281c10c63791067d24d421f7c43a15faa9096 (git)
Linux	Linux	Affected: 4.3 Unaffected: 0 , < 4.3 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-64438",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:40:43.590817Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:38:29.035Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/intel/qat/qat_common/adf_accel_devices.h",
            "drivers/crypto/intel/qat/qat_common/adf_common_drv.h",
            "drivers/crypto/intel/qat/qat_common/adf_isr.c",
            "drivers/crypto/intel/qat/qat_common/adf_sriov.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "218c2836b3987f3fa1d9eac505462cded0821e4c",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            },
            {
              "lessThan": "446b4d77599cf1a168573f7fb32a4a6aa4f09219",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            },
            {
              "lessThan": "5d916c1eae1933511a69bffe243b4ee5d7da399c",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            },
            {
              "lessThan": "f344a369d0380d54c8d6c8d24734a78dd5a89817",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            },
            {
              "lessThan": "51144032248cc4ea22917370565650670b8b4e9b",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            },
            {
              "lessThan": "49cd5ac6de8de39a14ead609bb552d372d5602cd",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            },
            {
              "lessThan": "6e92b28cd74fa433658efeadf21b9d4b01023d7d",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            },
            {
              "lessThan": "277281c10c63791067d24d421f7c43a15faa9096",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/intel/qat/qat_common/adf_accel_devices.h",
            "drivers/crypto/intel/qat/qat_common/adf_common_drv.h",
            "drivers/crypto/intel/qat/qat_common/adf_isr.c",
            "drivers/crypto/intel/qat/qat_common/adf_sriov.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.3"
            },
            {
              "lessThan": "4.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - fix VF2PF work teardown race in adf_disable_sriov()\n\nThe VF2PF interrupt handler queues PF-side response work that stores a\nraw pointer to per-VF state (struct adf_accel_vf_info). Currently,\nadf_disable_sriov() destroys per-VF mutexes and frees vf_info without\nstopping new VF2PF work or waiting for in-flight workers to complete. A\nconcurrently scheduled or already queued worker can then dereference\nfreed memory.\n\nThis manifests as a use-after-free when KASAN is enabled:\n\n  BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0\n  Write of size 8 at addr 0000000000000260 by task kworker/24:2/...\n  Workqueue: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat]\n  Call Trace:\n    kasan_report+0x119/0x140\n    mutex_lock+0x76/0xe0\n    adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat]\n    adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat]\n    adf_iov_send_resp+0x8c/0xe0 [intel_qat]\n    process_one_work+0x6ac/0xfd0\n    worker_thread+0x4dd/0xd30\n    kthread+0x326/0x410\n    ret_from_fork+0x33b/0x670\n\nAdd a PF-local flag, vf2pf_disabled, that gates work queueing, worker\nprocessing, and interrupt re-enabling during teardown. Set this flag\natomically with the hardware interrupt mask inside\nadf_disable_all_vf2pf_interrupts(). After masking, synchronize the AE\ncluster MSI-X interrupt and flush the PF response workqueue before\ntearing down per-VF locks and state so all in-flight work completes\nbefore vf_info is destroyed.\n\nIntroduce adf_enable_all_vf2pf_interrupts() to clear the flag and\nunmask all VF2PF interrupts under the same lock when SR-IOV is\nre-enabled. This ensures the software flag and hardware state transition\natomically on both the enable and disable paths."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation originates from a local process or guest with direct access to an assigned QAT VF, using VF MMIO or the VF driver to generate VF2PF messages; it is not network-reachable.\nAC:L - The VF controls mailbox generation, restart-complete signaling, and acknowledgement behavior, and can keep response work active for up to one second while teardown proceeds. VF removal itself also emits shutdown traffic, making the race repeatedly attacker-alignable.\nPR:L - The attacker needs authorized access to an assigned QAT VF, which can be delegated through VFIO to an unprivileged process or tenant VM. No host administrative capability is required during management-initiated teardown or reset.\nUI:N - Exploitation requires no victim-user action; device teardown, hot-unplug, shutdown, or automatic error recovery supplies the concurrent lifecycle event.\nS:C - In a virtualized deployment, a tenant controlling an assigned VF corrupts memory in the host PF kernel, crossing the guest-to-host isolation boundary.\nC:H - The freed VF-state allocation contains kernel pointers and synchronization state, and reclamation of the stale object can support disclosure of arbitrary host-kernel memory.\nI:H - The worker performs writes through destroyed mutexes and stale pointers into freed or reallocated memory, providing memory-corruption primitives potentially usable for host-kernel code execution.\nA:H - The observed use-after-free produces invalid kernel writes and NULL-pointer dereferences, allowing a kernel oops or panic and complete host availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:55:39.854Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/218c2836b3987f3fa1d9eac505462cded0821e4c"
        },
        {
          "url": "https://git.kernel.org/stable/c/446b4d77599cf1a168573f7fb32a4a6aa4f09219"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d916c1eae1933511a69bffe243b4ee5d7da399c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f344a369d0380d54c8d6c8d24734a78dd5a89817"
        },
        {
          "url": "https://git.kernel.org/stable/c/51144032248cc4ea22917370565650670b8b4e9b"
        },
        {
          "url": "https://git.kernel.org/stable/c/49cd5ac6de8de39a14ead609bb552d372d5602cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e92b28cd74fa433658efeadf21b9d4b01023d7d"
        },
        {
          "url": "https://git.kernel.org/stable/c/277281c10c63791067d24d421f7c43a15faa9096"
        }
      ],
      "title": "crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64438",
    "datePublished": "2026-07-25T08:51:11.740Z",
    "dateReserved": "2026-07-19T15:36:31.788Z",
    "dateUpdated": "2026-10-19T20:38:29.035Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted