In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() The VF2PF… (CVE-2026-64438)
In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() The VF2PF interrupt handler queues PF-side response work that stores a raw pointer to per-VF state (struct adf_accel_vf_info). Currently, adf_disable_sriov() destroys per-VF mutexes and frees vf_info without stopping new VF2PF work or waiting for in-flight workers to complete. A concurrently scheduled or already queued worker can then dereference freed memory. This manifests as a use-after-free when KASAN is enabled: BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0 Write of size 8 at addr 0000000000000260 by task kworker/24:2/... Workqueue: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat] Call Trace: kasan_report+0x119/0x140 mutex_lock+0x76/0xe0 adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat] adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat] adf_iov_send_resp+0x8c/0xe0 [intel_qat] process_one_work+0x6ac/0xfd0 worker_thread+0x4dd/0xd30 kthread+0x326/0x410 ret_from_fork+0x33b/0x670 Add a PF-local flag, vf2pf_disabled, that gates work queueing, worker processing, and interrupt re-enabling during teardown. Set this flag atomically with the hardware interrupt mask inside adf_disable_all_vf2pf_interrupts(). After masking, synchronize the AE cluster MSI-X interrupt and flush the PF response workqueue before tearing down per-VF locks and state so all in-flight work completes before vf_info is destroyed. Introduce adf_enable_all_vf2pf_interrupts() to clear the flag and unmask all VF2PF interrupts under the same lock when SR-IOV is re-enabled. This ensures the software flag and hardware state transition atomically on both the enable and disable paths.
AI Analysis
Technical Summary
The Linux kernel's crypto qat driver contained a race condition in the VF2PF interrupt handler where the adf_disable_sriov() function destroyed per-VF mutexes and freed vf_info structures without stopping or waiting for in-flight VF2PF work to complete. This allowed concurrently scheduled or queued workers to dereference freed memory, causing use-after-free errors. The patch added a PF-local flag (vf2pf_disabled) to gate work queueing and processing during teardown, synchronized interrupt masking with workqueue flushing, and ensured all in-flight work completed before resource destruction. An enabling function was also added to atomically clear the flag and unmask interrupts when SR-IOV is re-enabled.
Potential Impact
The vulnerability could lead to use-after-free conditions in the kernel, potentially causing kernel crashes or instability when the affected code path is exercised, especially with KASAN enabled. There is no indication of remote exploitability or privilege escalation from the provided data.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this race condition by adding synchronization mechanisms during SR-IOV teardown and re-enabling. Users should update to the fixed kernel version containing this patch. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisories for the exact fixed versions and apply updates accordingly.
In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() The VF2PF… (CVE-2026-64438)
Description
In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() The VF2PF interrupt handler queues PF-side response work that stores a raw pointer to per-VF state (struct adf_accel_vf_info). Currently, adf_disable_sriov() destroys per-VF mutexes and frees vf_info without stopping new VF2PF work or waiting for in-flight workers to complete. A concurrently scheduled or already queued worker can then dereference freed memory. This manifests as a use-after-free when KASAN is enabled: BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0 Write of size 8 at addr 0000000000000260 by task kworker/24:2/... Workqueue: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat] Call Trace: kasan_report+0x119/0x140 mutex_lock+0x76/0xe0 adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat] adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat] adf_iov_send_resp+0x8c/0xe0 [intel_qat] process_one_work+0x6ac/0xfd0 worker_thread+0x4dd/0xd30 kthread+0x326/0x410 ret_from_fork+0x33b/0x670 Add a PF-local flag, vf2pf_disabled, that gates work queueing, worker processing, and interrupt re-enabling during teardown. Set this flag atomically with the hardware interrupt mask inside adf_disable_all_vf2pf_interrupts(). After masking, synchronize the AE cluster MSI-X interrupt and flush the PF response workqueue before tearing down per-VF locks and state so all in-flight work completes before vf_info is destroyed. Introduce adf_enable_all_vf2pf_interrupts() to clear the flag and unmask all VF2PF interrupts under the same lock when SR-IOV is re-enabled. This ensures the software flag and hardware state transition atomically on both the enable and disable paths.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's crypto qat driver contained a race condition in the VF2PF interrupt handler where the adf_disable_sriov() function destroyed per-VF mutexes and freed vf_info structures without stopping or waiting for in-flight VF2PF work to complete. This allowed concurrently scheduled or queued workers to dereference freed memory, causing use-after-free errors. The patch added a PF-local flag (vf2pf_disabled) to gate work queueing and processing during teardown, synchronized interrupt masking with workqueue flushing, and ensured all in-flight work completed before resource destruction. An enabling function was also added to atomically clear the flag and unmask interrupts when SR-IOV is re-enabled.
Potential Impact
The vulnerability could lead to use-after-free conditions in the kernel, potentially causing kernel crashes or instability when the affected code path is exercised, especially with KASAN enabled. There is no indication of remote exploitability or privilege escalation from the provided data.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this race condition by adding synchronization mechanisms during SR-IOV teardown and re-enabling. Users should update to the fixed kernel version containing this patch. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisories for the exact fixed versions and apply updates accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-j99q-5p83-43j8
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64438"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a6542099c2644c7f80835cd
Added to database: 07/25/2026, 23:08:57 UTC
Last enriched: 07/25/2026, 23:23:28 UTC
Last updated: 09/07/2026, 10:52:10 UTC
Views: 51
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.