CVE-2026-64438

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64438", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.788Z", "datePublished": "2026-07-25T08:51:11.740Z", "dateUpdated": "2026-10-19T20:38:29.035Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:55:39.854Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - fix VF2PF work teardown race in adf_disable_sriov()\n\nThe VF2PF interrupt handler queues PF-side response work that stores a\nraw pointer to per-VF state (struct adf_accel_vf_info). Currently,\nadf_disable_sriov() destroys per-VF mutexes and frees vf_info without\nstopping new VF2PF work or waiting for in-flight workers to complete. A\nconcurrently scheduled or already queued worker can then dereference\nfreed memory.\n\nThis manifests as a use-after-free when KASAN is enabled:\n\n BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0\n Write of size 8 at addr 0000000000000260 by task kworker/24:2/...\n Workqueue: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat]\n Call Trace:\n kasan_report+0x119/0x140\n mutex_lock+0x76/0xe0\n adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat]\n adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat]\n adf_iov_send_resp+0x8c/0xe0 [intel_qat]\n process_one_work+0x6ac/0xfd0\n worker_thread+0x4dd/0xd30\n kthread+0x326/0x410\n ret_from_fork+0x33b/0x670\n\nAdd a PF-local flag, vf2pf_disabled, that gates work queueing, worker\nprocessing, and interrupt re-enabling during teardown. Set this flag\natomically with the hardware interrupt mask inside\nadf_disable_all_vf2pf_interrupts(). After masking, synchronize the AE\ncluster MSI-X interrupt and flush the PF response workqueue before\ntearing down per-VF locks and state so all in-flight work completes\nbefore vf_info is destroyed.\n\nIntroduce adf_enable_all_vf2pf_interrupts() to clear the flag and\nunmask all VF2PF interrupts under the same lock when SR-IOV is\nre-enabled. This ensures the software flag and hardware state transition\natomically on both the enable and disable paths."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation originates from a local process or guest with direct access to an assigned QAT VF, using VF MMIO or the VF driver to generate VF2PF messages; it is not network-reachable.\nAC:L - The VF controls mailbox generation, restart-complete signaling, and acknowledgement behavior, and can keep response work active for up to one second while teardown proceeds. VF removal itself also emits shutdown traffic, making the race repeatedly attacker-alignable.\nPR:L - The attacker needs authorized access to an assigned QAT VF, which can be delegated through VFIO to an unprivileged process or tenant VM. No host administrative capability is required during management-initiated teardown or reset.\nUI:N - Exploitation requires no victim-user action; device teardown, hot-unplug, shutdown, or automatic error recovery supplies the concurrent lifecycle event.\nS:C - In a virtualized deployment, a tenant controlling an assigned VF corrupts memory in the host PF kernel, crossing the guest-to-host isolation boundary.\nC:H - The freed VF-state allocation contains kernel pointers and synchronization state, and reclamation of the stale object can support disclosure of arbitrary host-kernel memory.\nI:H - The worker performs writes through destroyed mutexes and stale pointers into freed or reallocated memory, providing memory-corruption primitives potentially usable for host-kernel code execution.\nA:H - The observed use-after-free produces invalid kernel writes and NULL-pointer dereferences, allowing a kernel oops or panic and complete host availability loss."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/crypto/intel/qat/qat_common/adf_accel_devices.h", "drivers/crypto/intel/qat/qat_common/adf_common_drv.h", "drivers/crypto/intel/qat/qat_common/adf_isr.c", "drivers/crypto/intel/qat/qat_common/adf_sriov.c"], "versions": [{"version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "lessThan": "218c2836b3987f3fa1d9eac505462cded0821e4c", "status": "affected", "versionType": "git"}, {"version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "lessThan": "446b4d77599cf1a168573f7fb32a4a6aa4f09219", "status": "affected", "versionType": "git"}, {"version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "lessThan": "5d916c1eae1933511a69bffe243b4ee5d7da399c", "status": "affected", "versionType": "git"}, {"version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "lessThan": "f344a369d0380d54c8d6c8d24734a78dd5a89817", "status": "affected", "versionType": "git"}, {"version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "lessThan": "51144032248cc4ea22917370565650670b8b4e9b", "status": "affected", "versionType": "git"}, {"version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "lessThan": "49cd5ac6de8de39a14ead609bb552d372d5602cd", "status": "affected", "versionType": "git"}, {"version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "lessThan": "6e92b28cd74fa433658efeadf21b9d4b01023d7d", "status": "affected", "versionType": "git"}, {"version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "lessThan": "277281c10c63791067d24d421f7c43a15faa9096", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/crypto/intel/qat/qat_common/adf_accel_devices.h", "drivers/crypto/intel/qat/qat_common/adf_common_drv.h", "drivers/crypto/intel/qat/qat_common/adf_isr.c", "drivers/crypto/intel/qat/qat_common/adf_sriov.c"], "versions": [{"version": "4.3", "status": "affected"}, {"version": "0", "lessThan": "4.3", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.4", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "7.1.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/218c2836b3987f3fa1d9eac505462cded0821e4c"}, {"url": "https://git.kernel.org/stable/c/446b4d77599cf1a168573f7fb32a4a6aa4f09219"}, {"url": "https://git.kernel.org/stable/c/5d916c1eae1933511a69bffe243b4ee5d7da399c"}, {"url": "https://git.kernel.org/stable/c/f344a369d0380d54c8d6c8d24734a78dd5a89817"}, {"url": "https://git.kernel.org/stable/c/51144032248cc4ea22917370565650670b8b4e9b"}, {"url": "https://git.kernel.org/stable/c/49cd5ac6de8de39a14ead609bb552d372d5602cd"}, {"url": "https://git.kernel.org/stable/c/6e92b28cd74fa433658efeadf21b9d4b01023d7d"}, {"url": "https://git.kernel.org/stable/c/277281c10c63791067d24d421f7c43a15faa9096"}], "title": "crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64438", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:40:43.590817Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:38:29.035Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64438", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:40:43.590817Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:40:44.207Z"}}], "cna": {"title": "crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation originates from a local process or guest with direct access to an assigned QAT VF, using VF MMIO or the VF driver to generate VF2PF messages; it is not network-reachable.\nAC:L - The VF controls mailbox generation, restart-complete signaling, and acknowledgement behavior, and can keep response work active for up to one second while teardown proceeds. VF removal itself also emits shutdown traffic, making the race repeatedly attacker-alignable.\nPR:L - The attacker needs authorized access to an assigned QAT VF, which can be delegated through VFIO to an unprivileged process or tenant VM. No host administrative capability is required during management-initiated teardown or reset.\nUI:N - Exploitation requires no victim-user action; device teardown, hot-unplug, shutdown, or automatic error recovery supplies the concurrent lifecycle event.\nS:C - In a virtualized deployment, a tenant controlling an assigned VF corrupts memory in the host PF kernel, crossing the guest-to-host isolation boundary.\nC:H - The freed VF-state allocation contains kernel pointers and synchronization state, and reclamation of the stale object can support disclosure of arbitrary host-kernel memory.\nI:H - The worker performs writes through destroyed mutexes and stale pointers into freed or reallocated memory, providing memory-corruption primitives potentially usable for host-kernel code execution.\nA:H - The observed use-after-free produces invalid kernel writes and NULL-pointer dereferences, allowing a kernel oops or panic and complete host availability loss."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "lessThan": "218c2836b3987f3fa1d9eac505462cded0821e4c", "versionType": "git"}, {"status": "affected", "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "lessThan": "446b4d77599cf1a168573f7fb32a4a6aa4f09219", "versionType": "git"}, {"status": "affected", "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "lessThan": "5d916c1eae1933511a69bffe243b4ee5d7da399c", "versionType": "git"}, {"status": "affected", "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "lessThan": "f344a369d0380d54c8d6c8d24734a78dd5a89817", "versionType": "git"}, {"status": "affected", "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "lessThan": "51144032248cc4ea22917370565650670b8b4e9b", "versionType": "git"}, {"status": "affected", "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "lessThan": "49cd5ac6de8de39a14ead609bb552d372d5602cd", "versionType": "git"}, {"status": "affected", "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "lessThan": "6e92b28cd74fa433658efeadf21b9d4b01023d7d", "versionType": "git"}, {"status": "affected", "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "lessThan": "277281c10c63791067d24d421f7c43a15faa9096", "versionType": "git"}], "programFiles": ["drivers/crypto/intel/qat/qat_common/adf_accel_devices.h", "drivers/crypto/intel/qat/qat_common/adf_common_drv.h", "drivers/crypto/intel/qat/qat_common/adf_isr.c", "drivers/crypto/intel/qat/qat_common/adf_sriov.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.3"}, {"status": "unaffected", "version": "0", "lessThan": "4.3", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.261", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.212", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.178", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.145", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.97", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.4", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/crypto/intel/qat/qat_common/adf_accel_devices.h", "drivers/crypto/intel/qat/qat_common/adf_common_drv.h", "drivers/crypto/intel/qat/qat_common/adf_isr.c", "drivers/crypto/intel/qat/qat_common/adf_sriov.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/218c2836b3987f3fa1d9eac505462cded0821e4c"}, {"url": "https://git.kernel.org/stable/c/446b4d77599cf1a168573f7fb32a4a6aa4f09219"}, {"url": "https://git.kernel.org/stable/c/5d916c1eae1933511a69bffe243b4ee5d7da399c"}, {"url": "https://git.kernel.org/stable/c/f344a369d0380d54c8d6c8d24734a78dd5a89817"}, {"url": "https://git.kernel.org/stable/c/51144032248cc4ea22917370565650670b8b4e9b"}, {"url": "https://git.kernel.org/stable/c/49cd5ac6de8de39a14ead609bb552d372d5602cd"}, {"url": "https://git.kernel.org/stable/c/6e92b28cd74fa433658efeadf21b9d4b01023d7d"}, {"url": "https://git.kernel.org/stable/c/277281c10c63791067d24d421f7c43a15faa9096"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - fix VF2PF work teardown race in adf_disable_sriov()\n\nThe VF2PF interrupt handler queues PF-side response work that stores a\nraw pointer to per-VF state (struct adf_accel_vf_info). Currently,\nadf_disable_sriov() destroys per-VF mutexes and frees vf_info without\nstopping new VF2PF work or waiting for in-flight workers to complete. A\nconcurrently scheduled or already queued worker can then dereference\nfreed memory.\n\nThis manifests as a use-after-free when KASAN is enabled:\n\n BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0\n Write of size 8 at addr 0000000000000260 by task kworker/24:2/...\n Workqueue: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat]\n Call Trace:\n kasan_report+0x119/0x140\n mutex_lock+0x76/0xe0\n adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat]\n adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat]\n adf_iov_send_resp+0x8c/0xe0 [intel_qat]\n process_one_work+0x6ac/0xfd0\n worker_thread+0x4dd/0xd30\n kthread+0x326/0x410\n ret_from_fork+0x33b/0x670\n\nAdd a PF-local flag, vf2pf_disabled, that gates work queueing, worker\nprocessing, and interrupt re-enabling during teardown. Set this flag\natomically with the hardware interrupt mask inside\nadf_disable_all_vf2pf_interrupts(). After masking, synchronize the AE\ncluster MSI-X interrupt and flush the PF response workqueue before\ntearing down per-VF locks and state so all in-flight work completes\nbefore vf_info is destroyed.\n\nIntroduce adf_enable_all_vf2pf_interrupts() to clear the flag and\nunmask all VF2PF interrupts under the same lock when SR-IOV is\nre-enabled. This ensures the software flag and hardware state transition\natomically on both the enable and disable paths."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.261", "versionStartIncluding": "4.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.212", "versionStartIncluding": "4.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.178", "versionStartIncluding": "4.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.145", "versionStartIncluding": "4.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.97", "versionStartIncluding": "4.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.40", "versionStartIncluding": "4.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.4", "versionStartIncluding": "4.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "4.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:55:39.854Z"}}}, "cveMetadata": {"cveId": "CVE-2026-64438", "state": "PUBLISHED", "dateUpdated": "2026-10-19T20:38:29.035Z", "dateReserved": "2026-07-19T15:36:31.788Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-07-25T08:51:11.740Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/crypto/intel/qat/qat_common/adf_accel_devices.h", "drivers/crypto/intel/qat/qat_common/adf_common_drv.h", "drivers/crypto/intel/qat/qat_common/adf_isr.c", "drivers/crypto/intel/qat/qat_common/adf_sriov.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "218c2836b3987f3fa1d9eac505462cded0821e4c", "status": "affected", "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "versionType": "git"}, {"lessThan": "446b4d77599cf1a168573f7fb32a4a6aa4f09219", "status": "affected", "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "versionType": "git"}, {"lessThan": "5d916c1eae1933511a69bffe243b4ee5d7da399c", "status": "affected", "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "versionType": "git"}, {"lessThan": "f344a369d0380d54c8d6c8d24734a78dd5a89817", "status": "affected", "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "versionType": "git"}, {"lessThan": "51144032248cc4ea22917370565650670b8b4e9b", "status": "affected", "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "versionType": "git"}, {"lessThan": "49cd5ac6de8de39a14ead609bb552d372d5602cd", "status": "affected", "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "versionType": "git"}, {"lessThan": "6e92b28cd74fa433658efeadf21b9d4b01023d7d", "status": "affected", "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "versionType": "git"}, {"lessThan": "277281c10c63791067d24d421f7c43a15faa9096", "status": "affected", "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/crypto/intel/qat/qat_common/adf_accel_devices.h", "drivers/crypto/intel/qat/qat_common/adf_common_drv.h", "drivers/crypto/intel/qat/qat_common/adf_isr.c", "drivers/crypto/intel/qat/qat_common/adf_sriov.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.3"}, {"lessThan": "4.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.261", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "797E695E-C99E-4F7E-AC6C-38D5378E6A9B", "versionEndExcluding": "5.10.261", "versionStartIncluding": "4.3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8E99FB01-CD93-41AF-A653-3F450652B9A6", "versionEndExcluding": "5.15.212", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "092233C7-F4E0-40C8-BD4D-A28FE50DFE20", "versionEndExcluding": "6.1.178", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7046B092-F810-4440-ACE6-60218518EECE", "versionEndExcluding": "6.6.145", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "05880CF6-5AD2-44E9-853A-6CE8318E76A5", "versionEndExcluding": "6.12.97", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "67D87928-1419-4529-9201-42C059678CB4", "versionEndExcluding": "6.18.40", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42", "versionEndExcluding": "7.1.4", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - fix VF2PF work teardown race in adf_disable_sriov()\n\nThe VF2PF interrupt handler queues PF-side response work that stores a\nraw pointer to per-VF state (struct adf_accel_vf_info). Currently,\nadf_disable_sriov() destroys per-VF mutexes and frees vf_info without\nstopping new VF2PF work or waiting for in-flight workers to complete. A\nconcurrently scheduled or already queued worker can then dereference\nfreed memory.\n\nThis manifests as a use-after-free when KASAN is enabled:\n\n BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0\n Write of size 8 at addr 0000000000000260 by task kworker/24:2/...\n Workqueue: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat]\n Call Trace:\n kasan_report+0x119/0x140\n mutex_lock+0x76/0xe0\n adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat]\n adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat]\n adf_iov_send_resp+0x8c/0xe0 [intel_qat]\n process_one_work+0x6ac/0xfd0\n worker_thread+0x4dd/0xd30\n kthread+0x326/0x410\n ret_from_fork+0x33b/0x670\n\nAdd a PF-local flag, vf2pf_disabled, that gates work queueing, worker\nprocessing, and interrupt re-enabling during teardown. Set this flag\natomically with the hardware interrupt mask inside\nadf_disable_all_vf2pf_interrupts(). After masking, synchronize the AE\ncluster MSI-X interrupt and flush the PF response workqueue before\ntearing down per-VF locks and state so all in-flight work completes\nbefore vf_info is destroyed.\n\nIntroduce adf_enable_all_vf2pf_interrupts() to clear the flag and\nunmask all VF2PF interrupts under the same lock when SR-IOV is\nre-enabled. This ensures the software flag and hardware state transition\natomically on both the enable and disable paths."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncrypto: qat - correcci\u00f3n de la condici\u00f3n de carrera en la deshabilitaci\u00f3n del trabajo VF2PF en adf_disable_sriov()\n\nEl gestor de interrupciones VF2PF encola trabajo de respuesta del lado del PF que almacena un puntero sin procesar al estado por VF (struct adf_accel_vf_info). Actualmente, adf_disable_sriov() destruye los mutexes por VF y libera vf_info sin detener nuevo trabajo VF2PF o esperar a que los trabajadores en curso se completen. Un trabajador programado concurrentemente o ya encolado puede entonces desreferenciar memoria liberada.\n\nEsto se manifiesta como un uso despu\u00e9s de liberaci\u00f3n cuando KASAN est\u00e1 habilitado:\n\n ERROR: KASAN: null-ptr-deref en mutex_lock+0x76/0xe0\n Escritura de tama\u00f1o 8 en la direcci\u00f3n 0000000000000260 por la tarea kworker/24:2/...\n Cola de trabajo: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat]\n Rastro de Llamada:\n kasan_report+0x119/0x140\n mutex_lock+0x76/0xe0\n adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat]\n adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat]\n adf_iov_send_resp+0x8c/0xe0 [intel_qat]\n process_one_work+0x6ac/0xfd0\n worker_thread+0x4dd/0xd30\n kthread+0x326/0x410\n ret_from_fork+0x33b/0x670\n\nSe a\u00f1ade un indicador local de PF, vf2pf_disabled, que controla el encolamiento de trabajo, el procesamiento de trabajadores y la re-habilitaci\u00f3n de interrupciones durante la deshabilitaci\u00f3n. Este indicador se establece at\u00f3micamente con la m\u00e1scara de interrupci\u00f3n de hardware dentro de adf_disable_all_vf2pf_interrupts(). Despu\u00e9s de enmascarar, se sincroniza la interrupci\u00f3n MSI-X del cl\u00faster AE y se vac\u00eda la cola de trabajo de respuesta del PF antes de deshabilitar los bloqueos y el estado por VF para que todo el trabajo en curso se complete antes de que vf_info sea destruido.\n\nSe introduce adf_enable_all_vf2pf_interrupts() para borrar el indicador y desenmascarar todas las interrupciones VF2PF bajo el mismo bloqueo cuando SR-IOV es re-habilitado. Esto asegura que el indicador de software y el estado del hardware transicionen at\u00f3micamente tanto en las rutas de habilitaci\u00f3n como de deshabilitaci\u00f3n."}], "id": "CVE-2026-64438", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64438", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:40:43.590817Z", "version": "2.0.3"}}]}, "published": "2026-07-25T10:17:28.303", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/218c2836b3987f3fa1d9eac505462cded0821e4c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/277281c10c63791067d24d421f7c43a15faa9096"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/446b4d77599cf1a168573f7fb32a4a6aa4f09219"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/49cd5ac6de8de39a14ead609bb552d372d5602cd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/51144032248cc4ea22917370565650670b8b4e9b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5d916c1eae1933511a69bffe243b4ee5d7da399c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6e92b28cd74fa433658efeadf21b9d4b01023d7d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f344a369d0380d54c8d6c8d24734a78dd5a89817"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()", "id": "2507118", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507118"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's crypto QAT (QuickAssist Technology) module. A race condition exists during the teardown of Virtual Function to Physical Function (VF2PF) work in the `adf_disable_sriov()` function. This allows a concurrently scheduled or already queued worker to attempt to access memory that has already been freed, leading to a use-after-free vulnerability. This can result in a null-pointer dereference, potentially causing system instability or crashes."], "name": "CVE-2026-64438", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "impact": "moderate", "package_name": "erlang27", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64438\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64438\nhttps://lore.kernel.org/linux-cve-announce/2026072538-CVE-2026-64438-13b5@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ed8ccaef52fa03fb03cff45b380f72c9f869f273,218c2836b3987f3fa1d9eac505462cded0821e4c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ed8ccaef52fa03fb03cff45b380f72c9f869f273,446b4d77599cf1a168573f7fb32a4a6aa4f09219)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ed8ccaef52fa03fb03cff45b380f72c9f869f273,5d916c1eae1933511a69bffe243b4ee5d7da399c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ed8ccaef52fa03fb03cff45b380f72c9f869f273,f344a369d0380d54c8d6c8d24734a78dd5a89817)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ed8ccaef52fa03fb03cff45b380f72c9f869f273,51144032248cc4ea22917370565650670b8b4e9b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ed8ccaef52fa03fb03cff45b380f72c9f869f273,49cd5ac6de8de39a14ead609bb552d372d5602cd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ed8ccaef52fa03fb03cff45b380f72c9f869f273,6e92b28cd74fa433658efeadf21b9d4b01023d7d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ed8ccaef52fa03fb03cff45b380f72c9f869f273,277281c10c63791067d24d421f7c43a15faa9096)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.10.261,5.10.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.15.212,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.178,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.145,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.97,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.40,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1.4,7.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-25T19:45:03.151467+00:00", "updated": "2026-09-03T22:00:13.798806+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}