High 8.8Published Jul 25, 2026

CVE-2026-64438crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()

Updated under an hour ago (2026-10-19 07:00 UTC)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() The VF2PF interrupt handler queues PF-side response work that stores a raw pointer to per-VF state (struct adf_accel_vf_info). Currently, adf_disable_sriov() destroys per-VF mutexes and frees vf_info without stopping new VF2PF work or waiting for in-flight workers to complete. A concurrently scheduled or already queued worker can then dereference freed memory. This manifests as a use-after-free when KASAN is enabled: BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0 Write of size 8 at addr 0000000000000260 by task kworker/24:2/... Workqueue: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat] Call Trace: kasan_report+0x119/0x140 mutex_lock+0x76/0xe0 adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat] adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat] adf_iov_send_resp+0x8c/0xe0 [intel_qat] process_one_work+0x6ac/0xfd0 worker_thread+0x4dd/0xd30 kthread+0x326/0x410 ret_from_fork+0x33b/0x670 Add a PF-local flag, vf2pf_disabled, that gates work queueing, worker processing, and interrupt re-enabling during teardown. Set this flag atomically with the hardware interrupt mask inside adf_disable_all_vf2pf_interrupts(). After masking, synchronize the AE cluster MSI-X interrupt and flush the PF response workqueue before tearing down per-VF locks and state so all in-flight work completes before vf_info is destroyed. Introduce adf_enable_all_vf2pf_interrupts() to clear the flag and unmask all VF2PF interrupts under the same lock when SR-IOV is re-enabled. This ensures the software flag and hardware state transition atomically on both the enable and disable paths.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ed8ccaef52fa03fb03cff45b380f72c9f869f273 before 218c2836b3987f3fa1d9eac505462cded0821e4c; from ed8ccaef52fa03fb03cff45b380f72c9f869f273 before 446b4d77599cf1a168573f7fb32a4a6aa4f09219; from ed8ccaef52fa03fb03cff45b380f72c9f869f273 before 5d916c1eae1933511a69bffe243b4ee5d7da399c; from ed8ccaef52fa03fb03cff45b380f72c9f869f273 before f344a369d0380d54c8d6c8d24734a78dd5a89817; from ed8ccaef52fa03fb03cff45b380f72c9f869f273 before 51144032248cc4ea22917370565650670b8b4e9b; from ed8ccaef52fa03fb03cff45b380f72c9f869f273 before 49cd5ac6de8de39a14ead609bb552d372d5602cd; from ed8ccaef52fa03fb03cff45b380f72c9f869f273 before 6e92b28cd74fa433658efeadf21b9d4b01023d7d; from ed8ccaef52fa03fb03cff45b380f72c9f869f273 before 277281c10c63791067d24d421f7c43a15faa9096	CNA record
linux linux_kernel linux:linux_kernel	from 4.3 before 5.10.261; from 5.11 before 5.15.212; from 5.16 before 6.1.178; from 6.2 before 6.6.145; from 6.7 before 6.12.97; from 6.13 before 6.18.40; from 6.19 before 7.1.4	NVD

References

https://git.kernel.org/stable/c/218c2836b3987f3fa1d9eac505462cded0821e4cpatch
https://git.kernel.org/stable/c/446b4d77599cf1a168573f7fb32a4a6aa4f09219patch
https://git.kernel.org/stable/c/5d916c1eae1933511a69bffe243b4ee5d7da399cpatch
https://git.kernel.org/stable/c/f344a369d0380d54c8d6c8d24734a78dd5a89817patch
https://git.kernel.org/stable/c/51144032248cc4ea22917370565650670b8b4e9bpatch
https://git.kernel.org/stable/c/49cd5ac6de8de39a14ead609bb552d372d5602cdpatch
https://git.kernel.org/stable/c/6e92b28cd74fa433658efeadf21b9d4b01023d7dpatch
https://git.kernel.org/stable/c/277281c10c63791067d24d421f7c43a15faa9096patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.