CVE-2026-64438

Status: UPDATED  |  Advisory ID: CVE-2026-64438

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()

The VF2PF interrupt handler queues PF-side response work that stores a

raw pointer to per-VF state (struct adf_accel_vf_info). Currently,

adf_disable_sriov() destroys per-VF mutexes and frees vf_info without

stopping new VF2PF work or waiting for in-flight workers to complete. A

concurrently scheduled or already queued worker can then dereference

freed memory.

This manifests as a use-after-free when KASAN is enabled:

BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0

Write of size 8 at addr 0000000000000260 by task kworker/24:2/...

Workqueue: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat]

Call Trace:

kasan_report+0x119/0x140

mutex_lock+0x76/0xe0

adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat]

adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat]

adf_iov_send_resp+0x8c/0xe0 [intel_qat]

process_one_work+0x6ac/0xfd0

worker_thread+0x4dd/0xd30

kthread+0x326/0x410

ret_from_fork+0x33b/0x670

Add a PF-local flag, vf2pf_disabled, that gates work queueing, worker

processing, and interrupt re-enabling during teardown. Set this flag

atomically with the hardware interrupt mask inside

adf_disable_all_vf2pf_interrupts(). After masking, synchronize the AE

cluster MSI-X interrupt and flush the PF response workqueue before

tearing down per-VF locks and state so all in-flight work completes

before vf_info is destroyed.

Introduce adf_enable_all_vf2pf_interrupts() to clear the flag and

unmask all VF2PF interrupts under the same lock when SR-IOV is

re-enabled. This ensures the software flag and hardware state transition

atomically on both the enable and disable paths. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References