CVE-2026-64438: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
In the Linux kernel, the following vulnerability has been resolved:
crypto: qat - fix VF2PF work teardown race in adfdisablesriov()
The VF2PF interrupt handler queues PF-side response work that stores a raw pointer to per-VF state (struct adfaccelvfinfo). Currently, adfdisablesriov() destroys per-VF mutexes and frees vfinfo without stopping new VF2PF work or waiting for in-flight workers to complete. A concurrently scheduled or already queued worker can then dereference freed memory.
This manifests as a use-after-free when KASAN is enabled:
BUG: KASAN: null-ptr-deref in mutexlock+0x76/0xe0 Write of size 8 at addr 0000000000000260 by task kworker/24:2/... Workqueue: qatpf2vfrespwq adfiovsendresp [intelqat] Call Trace: kasanreport+0x119/0x140 mutexlock+0x76/0xe0 adfgen4pfvfsend+0xd4/0x1f0 [intelqat] adfrecvandhandlevf2pfmsg+0x290/0x360 [intelqat] adfiovsendresp+0x8c/0xe0 [intelqat] processonework+0x6ac/0xfd0 workerthread+0x4dd/0xd30 kthread+0x326/0x410 retfromfork+0x33b/0x670
Add a PF-local flag, vf2pfdisabled, that gates work queueing, worker processing, and interrupt re-enabling during teardown. Set this flag atomically with the hardware interrupt mask inside adfdisableallvf2pfinterrupts(). After masking, synchronize the AE cluster MSI-X interrupt and flush the PF response workqueue before tearing down per-VF locks and state so all in-flight work completes before vfinfo is destroyed.
Introduce adfenableallvf2pfinterrupts() to clear the flag and unmask all VF2PF interrupts under the same lock when SR-IOV is re-enabled. This ensures the software flag and hardware state transition atomically on both the enable and disable paths.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add a PF-local flag vf2pf_disabled that gates VF2PF work queueing; clear this flag in adf_enable_all_vf2pf_interrupts() so PF response workqueueing resumes only when hardware/software state transition is synchronized.
intel_qat (crypto: qat) vf2pf_disabled = enabled/disabled gating of work queueing (clear on enable path) - Compensating control
During SR-IOV teardown in adf_disable_sriov(), flush the PF response workqueue (qat_pf2vf_resp_wq) and ensure VF2PF work is not concurrently scheduled or already queued can dereference freed vf_info; flush PF response workqueue before vf_info and per-VF mutexes are destroyed.
- Operational
After applying the kernel/qat fix, ensure SR-IOV teardown/enabling is performed with the corrected interrupt mask/flag synchronization so in-flight VF2PF workers complete before per-VF locks/state are freed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64438?
The severity of CVE-2026-64438 is rated as high with a CVSS score of 8.8.
What vulnerability does CVE-2026-64438 address?
CVE-2026-64438 addresses a race condition in the VF2PF work teardown process in the Linux kernel's crypto qat module.
How do I fix CVE-2026-64438?
To fix CVE-2026-64438, update to the latest version of the Linux kernel that includes the patch for this vulnerability.
What impact does CVE-2026-64438 have on system security?
CVE-2026-64438 can potentially lead to use-after-free vulnerabilities, allowing an attacker to execute arbitrary code.
Which software is vulnerable to CVE-2026-64438?
CVE-2026-64438 affects the Linux Kernel and the intel_qat driver.