CVE-2025-39721crypto: qat - flush misc workqueue during device shutdown
Updated under an hour ago ()
Does this affect you?
It affects Linux and 4 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: crypto: qat - flush misc workqueue during device shutdown Repeated loading and unloading of a device specific QAT driver, for example qat_4xxx, in a tight loop can lead to a crash due to a use-after-free scenario. This occurs when a power management (PM) interrupt triggers just before the device-specific driver (e.g., qat_4xxx.ko) is unloaded, while the core driver (intel_qat.ko) remains loaded. Since the driver uses a shared workqueue (`qat_misc_wq`) across all devices and owned by intel_qat.ko, a deferred routine from the device-specific driver may still be pending in the queue. If this routine executes after the driver is unloaded, it can dereference freed memory, resulting in a page fault and kernel crash like the following: BUG: unable to handle page fault for address: ffa000002e50a01c #PF: supervisor read access in kernel mode RIP: 0010:pm_bh_handler+0x1d2/0x250 [intel_qat] Call Trace: pm_bh_handler+0x1d2/0x250 [intel_qat] process_one_work+0x171/0x340 worker_thread+0x277/0x3a0 kthread+0xf0/0x120 ret_from_fork+0x2d/0x50 To prevent this, flush the misc workqueue during device shutdown to ensure that all pending work items are completed before the driver is unloaded. Note: This approach may slightly increase shutdown latency if the workqueue contains jobs from other devices, but it ensures correctness and stability.
- CVSS
- 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | from e5745f34113b758b45d134dec04a7df94dc67131 before fa4c14a82747886d333d8baef0d26da86ba1ccf7; from e5745f34113b758b45d134dec04a7df94dc67131 before 5858448a6c65d8ee3f8600570d3ce19febcb33be; from e5745f34113b758b45d134dec04a7df94dc67131 before fe546f5c50fc474daca6bee72caa7ab68a74c33d; from e5745f34113b758b45d134dec04a7df94dc67131 before e59a52e429e13df3feb34f4853a8e36d121ed937; from e5745f34113b758b45d134dec04a7df94dc67131 before 3d4df408ba9bad2b205c7fb8afc1836a6a4ca88a | CNA record |
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
linux linux_kernel linux:linux_kernel | from 5.18 before 6.6.103; from 6.7 before 6.12.44; from 6.13 before 6.16.4 | NVD |
References
- https://git.kernel.org/stable/c/fa4c14a82747886d333d8baef0d26da86ba1ccf7patch
- https://git.kernel.org/stable/c/5858448a6c65d8ee3f8600570d3ce19febcb33bepatch
- https://git.kernel.org/stable/c/fe546f5c50fc474daca6bee72caa7ab68a74c33dpatch
- https://git.kernel.org/stable/c/e59a52e429e13df3feb34f4853a8e36d121ed937patch
- https://git.kernel.org/stable/c/3d4df408ba9bad2b205c7fb8afc1836a6a4ca88apatch
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.