In the Linux kernel, the following vulnerability has been resolved: crypto: qat - protect service table iterations with service_lock The… (CVE-2026-64305)
In the Linux kernel, the following vulnerability has been resolved: crypto: qat - protect service table iterations with service_lock The service_table list is protected by service_lock when entries are added or removed (in adf_service_add() and adf_service_remove()), but several functions iterate over the list without holding this lock. A concurrent adf_service_register() or adf_service_unregister() call could modify the list during traversal, leading to list corruption or a use-after-free. Fix this by holding service_lock across all list_for_each_entry() iterations of service_table in adf_dev_init(), adf_dev_start(), adf_dev_stop(), adf_dev_shutdown(), adf_dev_restarting_notify(), adf_dev_restarted_notify(), and adf_error_notifier(). The lock ordering is safe: callers of the static helpers (adf_dev_up() and adf_dev_down()) acquire state_lock before service_lock, and no event_hld callback or service_lock holder ever acquires state_lock in the reverse order.
AI Analysis
Technical Summary
The Linux kernel's crypto qat driver maintained a service_table list protected by service_lock during additions and removals. However, several functions iterated over this list without holding the lock, allowing concurrent modifications via adf_service_register() or adf_service_unregister() to cause list corruption or use-after-free. The fix involves holding service_lock during all list_for_each_entry() iterations of service_table in multiple functions, ensuring safe lock ordering with state_lock to prevent deadlocks.
Potential Impact
Without proper locking, concurrent modifications to the service_table list could cause memory corruption or use-after-free vulnerabilities, potentially leading to kernel instability or crashes. No known exploits in the wild have been reported. The impact is limited to kernel memory safety and stability.
Mitigation Recommendations
A fix is available that ensures service_lock is held during all iterations of the service_table list in the affected functions. Users should update their Linux kernel to a version that includes this fix. No additional mitigations are indicated.
In the Linux kernel, the following vulnerability has been resolved: crypto: qat - protect service table iterations with service_lock The… (CVE-2026-64305)
Description
In the Linux kernel, the following vulnerability has been resolved: crypto: qat - protect service table iterations with service_lock The service_table list is protected by service_lock when entries are added or removed (in adf_service_add() and adf_service_remove()), but several functions iterate over the list without holding this lock. A concurrent adf_service_register() or adf_service_unregister() call could modify the list during traversal, leading to list corruption or a use-after-free. Fix this by holding service_lock across all list_for_each_entry() iterations of service_table in adf_dev_init(), adf_dev_start(), adf_dev_stop(), adf_dev_shutdown(), adf_dev_restarting_notify(), adf_dev_restarted_notify(), and adf_error_notifier(). The lock ordering is safe: callers of the static helpers (adf_dev_up() and adf_dev_down()) acquire state_lock before service_lock, and no event_hld callback or service_lock holder ever acquires state_lock in the reverse order.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's crypto qat driver maintained a service_table list protected by service_lock during additions and removals. However, several functions iterated over this list without holding the lock, allowing concurrent modifications via adf_service_register() or adf_service_unregister() to cause list corruption or use-after-free. The fix involves holding service_lock during all list_for_each_entry() iterations of service_table in multiple functions, ensuring safe lock ordering with state_lock to prevent deadlocks.
Potential Impact
Without proper locking, concurrent modifications to the service_table list could cause memory corruption or use-after-free vulnerabilities, potentially leading to kernel instability or crashes. No known exploits in the wild have been reported. The impact is limited to kernel memory safety and stability.
Mitigation Recommendations
A fix is available that ensures service_lock is held during all iterations of the service_table list in the affected functions. Users should update their Linux kernel to a version that includes this fix. No additional mitigations are indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-rf9w-458j-7pqc
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64305"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a65420d9c2644c7f8085cf7
Added to database: 07/25/2026, 23:09:01 UTC
Last enriched: 07/25/2026, 23:36:29 UTC
Last updated: 09/08/2026, 10:52:11 UTC
Views: 39
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.