The Linux kernel's crypto qat driver maintained a service_table list protected by service_lock during additions and removals. However, several functions iterated over this list without holding the lock, allowing concurrent modifications via adf_service_register() or adf_service_unregister() to cause list corruption or use-after-free. The fix involves holding service_lock during all list_for_each_entry() iterations of service_table in multiple functions, ensuring safe lock ordering with state_lock to prevent deadlocks.

Without proper locking, concurrent modifications to the service_table list could cause memory corruption or use-after-free vulnerabilities, potentially leading to kernel instability or crashes. No known exploits in the wild have been reported. The impact is limited to kernel memory safety and stability.

A fix is available that ensures service_lock is held during all iterations of the service_table list in the affected functions. Users should update their Linux kernel to a version that includes this fix. No additional mitigations are indicated.