CVE-2025-39721: crypto: qat - flush misc workqueue during device shutdown

Published Sep 5, 2025
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

crypto: qat - flush misc workqueue during device shutdown

Repeated loading and unloading of a device specific QAT driver, for example qat4xxx, in a tight loop can lead to a crash due to a use-after-free scenario. This occurs when a power management (PM) interrupt triggers just before the device-specific driver (e.g., qat4xxx.ko) is unloaded, while the core driver (intelqat.ko) remains loaded.

Since the driver uses a shared workqueue (qatmiscwq) across all devices and owned by intelqat.ko, a deferred routine from the device-specific driver may still be pending in the queue. If this routine executes after the driver is unloaded, it can dereference freed memory, resulting in a page fault and kernel crash like the following:

BUG: unable to handle page fault for address: ffa000002e50a01c #PF: supervisor read access in kernel mode RIP: 0010:pmbhhandler+0x1d2/0x250 [intelqat] Call Trace: pmbhhandler+0x1d2/0x250 [intelqat] processonework+0x171/0x340 workerthread+0x277/0x3a0 kthread+0xf0/0x120 retfromfork+0x2d/0x50

To prevent this, flush the misc workqueue during device shutdown to ensure that all pending work items are completed before the driver is unloaded.

Note: This approach may slightly increase shutdown latency if the workqueue contains jobs from other devices, but it ensures correctness and stability.

Affected Software

4 affected components
Linux Linux kernel=not specified
Linux Linux kernel>=5.18<6.6.103
Linux Linux kernel>=6.7<6.12.44
Linux Linux kernel>=6.13<6.16.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Configuration

    Flush the misc workqueue used by the QAT misc worker (qat_misc_wq) during device shutdown so that any pending work items are completed before the device-specific QAT driver (e.g., qat_4xxx.ko) is unloaded while the core driver (intel_qat.ko) remains loaded.

    intel_qat QAT driver (workqueue shutdown behavior) flush misc workqueue during device shutdown = enabled

Event History

Sep 5, 2025
CVE Published
via MITRE·05:21 PM
Data Sourced
via MITRE·05:21 PM
Description
Data Sourced
via NVD·06:15 PM
RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2025-39721?

CVE-2025-39721 has a high severity level due to its potential to cause crashes from a use-after-free scenario.

2

How do I fix CVE-2025-39721?

To fix CVE-2025-39721, ensure that you are using an updated Linux kernel that has addressed this vulnerability.

3

What components are affected by CVE-2025-39721?

CVE-2025-39721 affects the Linux kernel, specifically the QAT driver for devices like qat_4xxx.

4

What can be the impact of CVE-2025-39721?

The impact of CVE-2025-39721 includes potential system crashes when repeatedly loading and unloading the QAT driver.

5

Is CVE-2025-39721 a new vulnerability?

CVE-2025-39721 is not a new vulnerability as it has been identified and addressed in recent Linux kernel updates.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203