The Linux kernel's crypto qat driver contained a race condition in the VF2PF interrupt handler where the adf_disable_sriov() function destroyed per-VF mutexes and freed vf_info structures without stopping or waiting for in-flight VF2PF work to complete. This allowed concurrently scheduled or queued workers to dereference freed memory, causing use-after-free errors. The patch added a PF-local flag (vf2pf_disabled) to gate work queueing and processing during teardown, synchronized interrupt masking with workqueue flushing, and ensured all in-flight work completed before resource destruction. An enabling function was also added to atomically clear the flag and unmask interrupts when SR-IOV is re-enabled.

The vulnerability could lead to use-after-free conditions in the kernel, potentially causing kernel crashes or instability when the affected code path is exercised, especially with KASAN enabled. There is no indication of remote exploitability or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to address this race condition by adding synchronization mechanisms during SR-IOV teardown and re-enabling. Users should update to the fixed kernel version containing this patch. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisories for the exact fixed versions and apply updates accordingly.