CVE-2025-39721: crypto: qat - flush misc workqueue during device shutdown
In the Linux kernel, the following vulnerability has been resolved:
crypto: qat - flush misc workqueue during device shutdown
Repeated loading and unloading of a device specific QAT driver, for example qat4xxx, in a tight loop can lead to a crash due to a use-after-free scenario. This occurs when a power management (PM) interrupt triggers just before the device-specific driver (e.g., qat4xxx.ko) is unloaded, while the core driver (intelqat.ko) remains loaded.
Since the driver uses a shared workqueue (qatmiscwq) across all devices and owned by intelqat.ko, a deferred routine from the device-specific driver may still be pending in the queue. If this routine executes after the driver is unloaded, it can dereference freed memory, resulting in a page fault and kernel crash like the following:
BUG: unable to handle page fault for address: ffa000002e50a01c #PF: supervisor read access in kernel mode RIP: 0010:pmbhhandler+0x1d2/0x250 [intelqat] Call Trace: pmbhhandler+0x1d2/0x250 [intelqat] processonework+0x171/0x340 workerthread+0x277/0x3a0 kthread+0xf0/0x120 retfromfork+0x2d/0x50
To prevent this, flush the misc workqueue during device shutdown to ensure that all pending work items are completed before the driver is unloaded.
Note: This approach may slightly increase shutdown latency if the workqueue contains jobs from other devices, but it ensures correctness and stability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Flush the misc workqueue used by the QAT misc worker (qat_misc_wq) during device shutdown so that any pending work items are completed before the device-specific QAT driver (e.g., qat_4xxx.ko) is unloaded while the core driver (intel_qat.ko) remains loaded.
intel_qat QAT driver (workqueue shutdown behavior) flush misc workqueue during device shutdown = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39721?
CVE-2025-39721 has a high severity level due to its potential to cause crashes from a use-after-free scenario.
How do I fix CVE-2025-39721?
To fix CVE-2025-39721, ensure that you are using an updated Linux kernel that has addressed this vulnerability.
What components are affected by CVE-2025-39721?
CVE-2025-39721 affects the Linux kernel, specifically the QAT driver for devices like qat_4xxx.
What can be the impact of CVE-2025-39721?
The impact of CVE-2025-39721 includes potential system crashes when repeatedly loading and unloading the QAT driver.
Is CVE-2025-39721 a new vulnerability?
CVE-2025-39721 is not a new vulnerability as it has been identified and addressed in recent Linux kernel updates.