In the Linux kernel, the following vulnerability has been resolved:

crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()

The VF2PF interrupt handler queues PF-side response work that stores a
raw pointer to per-VF state (struct adf_accel_vf_info). Currently,
adf_disable_sriov() destroys per-VF mutexes and frees vf_info without
stopping new VF2PF work or waiting for in-flight workers to complete. A
concurrently scheduled or already queued worker can then dereference
freed memory.

This manifests as a use-after-free when KASAN is enabled:

  BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0
  Write of size 8 at addr 0000000000000260 by task kworker/24:2/...
  Workqueue: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat]
  Call Trace:
    kasan_report+0x119/0x140
    mutex_lock+0x76/0xe0
    adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat]
    adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat]
    adf_iov_send_resp+0x8c/0xe0 [intel_qat]
    process_one_work+0x6ac/0xfd0
    worker_thread+0x4dd/0xd30
    kthread+0x326/0x410
    ret_from_fork+0x33b/0x670

Add a PF-local flag, vf2pf_disabled, that gates work queueing, worker
processing, and interrupt re-enabling during teardown. Set this flag
atomically with the hardware interrupt mask inside
adf_disable_all_vf2pf_interrupts(). After masking, synchronize the AE
cluster MSI-X interrupt and flush the PF response workqueue before
tearing down per-VF locks and state so all in-flight work completes
before vf_info is destroyed.

Introduce adf_enable_all_vf2pf_interrupts() to clear the flag and
unmask all VF2PF interrupts under the same lock when SR-IOV is
re-enabled. This ensures the software flag and hardware state transition
atomically on both the enable and disable paths.

CVE-2026-64438: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() in Linux kernel

linux-aws

linux-azure

linux-lts-xenial

linux

linux-aws-hwe

linux-gcp

linux-hwe

linux-hwe-edge

linux-kvm

linux-oracle

linux-fips

linux-aws-5.0

linux-aws-5.3

linux-aws-5.4

linux-azure-4.15

linux-azure-5.3

linux-azure-5.4

linux-azure-edge

linux-gcp-4.15

linux-gcp-5.3

linux-gcp-5.4

linux-gke-4.15

linux-gke-5.4

linux-gkeop-5.4

linux-hwe-5.4

linux-ibm-5.4

linux-oem

linux-oracle-5.0

linux-oracle-5.3

linux-oracle-5.4

linux-raspi-5.4

linux-aws-fips

linux-azure-fips

linux-gcp-fips

linux-aws-5.11

linux-aws-5.13

linux-aws-5.15

linux-aws-5.8

linux-azure-5.11

linux-azure-5.13

linux-azure-5.15

linux-azure-5.8

linux-azure-fde

linux-azure-fde-5.15

linux-bluefield

linux-gcp-5.11

linux-gcp-5.13

linux-gcp-5.15

linux-gcp-5.8

linux-gke

linux-gke-5.15

linux-gkeop

linux-gkeop-5.15

linux-hwe-5.11

linux-hwe-5.13

linux-hwe-5.15

linux-hwe-5.8

linux-ibm

linux-ibm-5.15

linux-intel-5.13

linux-intel-iotg-5.15

linux-iot

linux-lowlatency-hwe-5.15

linux-nvidia-tegra-5.15

linux-oem-5.10

linux-oem-5.13

linux-oem-5.14

linux-oem-5.6

linux-oracle-5.11

linux-oracle-5.13

linux-oracle-5.15

linux-oracle-5.8

linux-raspi

linux-raspi2

linux-riscv

linux-riscv-5.11

linux-riscv-5.15

linux-riscv-5.8

linux-xilinx-zynqmp

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() The VF2PF interrupt handler queues PF-side response work that stores a raw pointer to per-VF state (struct adf_accel_vf_info). Currently, adf_disable_sriov() destroys per-VF mutexes and frees vf_info without stopping new VF2PF work or waiting for in-flight workers to complete. A concurrently scheduled or already queued worker can then dereference freed memory. This manifests as a use-after-free when KASAN is enabled:   BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0   Write of size 8 at addr 0000000000000260 by task kworker/24:2/...   Workqueue: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat]   Call Trace:     kasan_report+0x119/0x140     mutex_lock+0x76/0xe0     adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat]     adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat]     adf_iov_send_resp+0x8c/0xe0 [intel_qat]     process_one_work+0x6ac/0xfd0     worker_thread+0x4dd/0xd30     kthread+0x326/0x410     ret_from_fork+0x33b/0x670 Add a PF-local flag, vf2pf_disabled, that gates work queueing, worker processing, and interrupt re-enabling during teardown. Set this flag atomically with the hardware interrupt mask inside adf_disable_all_vf2pf_interrupts(). After masking, synchronize the AE cluster MSI-X interrupt and flush the PF response workqueue before tearing down per-VF locks and state so all in-flight work completes before vf_info is destroyed. Introduce adf_enable_all_vf2pf_interrupts() to clear the flag and unmask all VF2PF interrupts under the same lock when SR-IOV is re-enabled. This ensures the software flag and hardware state transition atomically on both the enable and disable paths.

CVE-2026-64438 is a use-after-free vulnerability in the Linux kernel's Intel QAT driver related to the VF2PF interrupt handler and SR-IOV teardown process. The flaw occurs because the adf_disable_sriov() function destroys per-VF mutexes and frees VF state without properly stopping or waiting for in-flight work, leading to potential dereferencing of freed memory. This issue has been fixed by introducing a PF-local flag to gate work queueing and synchronizing interrupt masking and workqueue flushing before teardown.

Search: CVE-2026-64438