CVE-2026-64529: crypto: qat - remove unused character device and IOCTLs
In the Linux kernel, the following vulnerability has been resolved:
crypto: qat - remove unused character device and IOCTLs
The QAT driver exposes a character device (qatadfctl) with IOCTLs for device configuration, start, stop, status query and enumeration. These IOCTLs are not part of any public uAPI header and have no known in-tree or out-of-tree users. Device lifecycle is already managed via sysfs.
The ioctl interface also increases the attack surface and is the subject of a number of bug reports.
Remove the character device, the IOCTL definitions, and the related data structures (adfdevstatusinfo, adfusercfgkeyval, adfusercfgsection, adfusercfgctldata). Drop the now-unused adfcfguser.h header and strip adfctldrv.c down to the minimal moduleinit/moduleexit hooks for workqueue, AER, and crypto/compression algorithm registration.
Clean up leftover dead code that was only reachable from the removed IOCTL paths: adfcfgdelall(), adfdevmgrverifyid(), adfdevmgrgetnumdev(), adfdevmgrgetdevbyid(), adfgetvfrealid() and the unused ADFCFG macros.
Additionally, drop the entry associated to QAT IOCTLs in ioctl-number.rst.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64529?
CVE-2026-64529 has a severity rating of 5, indicating a moderate risk level.
How do I fix CVE-2026-64529?
To fix CVE-2026-64529, ensure that your Linux kernel is updated to the latest version where this vulnerability is patched.
What systems are affected by CVE-2026-64529?
CVE-2026-64529 affects systems using the Linux kernel with the QAT driver.
What does CVE-2026-64529 expose?
CVE-2026-64529 exposes unused character device IOCTLs in the QAT driver that could potentially lead to misuse.
Is there a known exploit for CVE-2026-64529?
As of now, there are no publicly known exploits for CVE-2026-64529.