{"id":"CVE-2026-64438","revision":"bf2785107cdd4f7cb71778db4204950e","records":[{"revision":"bf2785107cdd4f7cb71778db4204950e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-64438","aliases":[],"title":"crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - fix VF2PF work teardown race in adf_disable_sriov()\n\nThe VF2PF interrupt handler queues PF-side response work that stores a\nraw pointer to per-VF state (struct adf_accel_vf_info). Currently,\nadf_disable_sriov() destroys per-VF mutexes and frees vf_info without\nstopping new VF2PF work or waiting for in-flight workers to complete. A\nconcurrently scheduled or already queued worker can then dereference\nfreed memory.\n\nThis manifests as a use-after-free when KASAN is enabled:\n\n BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0\n Write of size 8 at addr 0000000000000260 by task kworker/24:2/...\n Workqueue: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat]\n Call Trace:\n kasan_report+0x119/0x140\n mutex_lock+0x76/0xe0\n adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat]\n adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat]\n adf_iov_send_resp+0x8c/0xe0 [intel_qat]\n process_one_work+0x6ac/0xfd0\n worker_thread+0x4dd/0xd30\n kthread+0x326/0x410\n ret_from_fork+0x33b/0x670\n\nAdd a PF-local flag, vf2pf_disabled, that gates work queueing, worker\nprocessing, and interrupt re-enabling during teardown. Set this flag\natomically with the hardware interrupt mask inside\nadf_disable_all_vf2pf_interrupts(). After masking, synchronize the AE\ncluster MSI-X interrupt and flush the PF response workqueue before\ntearing down per-VF locks and state so all in-flight work completes\nbefore vf_info is destroyed.\n\nIntroduce adf_enable_all_vf2pf_interrupts() to clear the flag and\nunmask all VF2PF interrupts under the same lock when SR-IOV is\nre-enabled. This ensures the software flag and hardware state transition\natomically on both the enable and disable paths.","state":0,"publishedAt":"2026-07-25T08:51:11.74+00:00","modifiedAt":"2026-10-19T20:38:29.035+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"drivers/crypto/intel/qat/qat_common/adf_accel_devices.h\",\n \"drivers/crypto/intel/qat/qat_common/adf_common_drv.h\",\n \"drivers/crypto/intel/qat/qat_common/adf_isr.c\",\n \"drivers/crypto/intel/qat/qat_common/adf_sriov.c\"\n ],\n \"versions\": [\n {\n \"version\": \"ed8ccaef52fa03fb03cff45b380f72c9f869f273\",\n \"lessThan\": \"218c2836b3987f3fa1d9eac505462cded0821e4c\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"ed8ccaef52fa03fb03cff45b380f72c9f869f273\",\n \"lessThan\": \"446b4d77599cf1a168573f7fb32a4a6aa4f09219\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"ed8ccaef52fa03fb03cff45b380f72c9f869f273\",\n \"lessThan\": \"5d916c1eae1933511a69bffe243b4ee5d7da399c\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"ed8ccaef52fa03fb03cff45b380f72c9f869f273\",\n \"lessThan\": \"f344a369d0380d54c8d6c8d24734a78dd5a89817\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"ed8ccaef52fa03fb03cff45b380f72c9f869f273\",\n \"lessThan\": \"51144032248cc4ea22917370565650670b8b4e9b\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"ed8ccaef52fa03fb03cff45b380f72c9f869f273\",\n \"lessThan\": \"49cd5ac6de8de39a14ead609bb552d372d5602cd\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"ed8ccaef52fa03fb03cff45b380f72c9f869f273\",\n \"lessThan\": \"6e92b28cd74fa433658efeadf21b9d4b01023d7d\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"ed8ccaef52fa03fb03cff45b380f72c9f869f273\",\n \"lessThan\": \"277281c10c63791067d24d421f7c43a15faa9096\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"drivers/crypto/intel/qat/qat_common/adf_accel_devices.h\",\n \"drivers/crypto/intel/qat/qat_common/adf_common_drv.h\",\n \"drivers/crypto/intel/qat/qat_common/adf_isr.c\",\n \"drivers/crypto/intel/qat/qat_common/adf_sriov.c\"\n ],\n \"versions\": [\n {\n \"version\": \"4.3\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"4.3\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.10.261\",\n \"lessThanOrEqual\": \"5.10.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.15.212\",\n \"lessThanOrEqual\": \"5.15.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.178\",\n \"lessThanOrEqual\": \"6.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.145\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.97\",\n \"lessThanOrEqual\": \"6.12.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.18.40\",\n \"lessThanOrEqual\": \"6.18.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.1.4\",\n \"lessThanOrEqual\": \"7.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.2\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/218c2836b3987f3fa1d9eac505462cded0821e4c","https://git.kernel.org/stable/c/446b4d77599cf1a168573f7fb32a4a6aa4f09219","https://git.kernel.org/stable/c/5d916c1eae1933511a69bffe243b4ee5d7da399c","https://git.kernel.org/stable/c/f344a369d0380d54c8d6c8d24734a78dd5a89817","https://git.kernel.org/stable/c/51144032248cc4ea22917370565650670b8b4e9b","https://git.kernel.org/stable/c/49cd5ac6de8de39a14ead609bb552d372d5602cd","https://git.kernel.org/stable/c/6e92b28cd74fa433658efeadf21b9d4b01023d7d","https://git.kernel.org/stable/c/277281c10c63791067d24d421f7c43a15faa9096"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64438","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-64438","identifiers":["CVE-2026-64438"]},"retained":false,"historicalAffected":[]}],"coverage":[]}