CVE-2026-93162: crypto: qat - cancel work on re-enable SR-IOV timeout
In the Linux kernel, the following vulnerability has been resolved:
crypto: qat - cancel work on re-enable SR-IOV timeout
The QAT reset worker queues SR-IOV reenable work using a workstruct and completion embedded in an on-stack adfsriovdevdata. If the completion wait times out, the reset worker can return while devicesriovwq still holds or executes the stack-backed work item.
Cancel the work on the devicesriovwq on timeout before the stack frame unwinds.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel QAT crypto driver with SR-IOV re-enable activity during a QAT reset are exposed. The issue specifically involves the reset worker and the device SR-IOV workqueue.
What condition is required to trigger the vulnerability?
The wait for SR-IOV re-enable completion must time out while the queued re-enable work is still held or executed by device_sriov_wq. The reset worker can then return and unwind the stack frame containing the work item and completion.
What is the mitigation if the fix cannot be applied immediately?
No workaround is provided in the available data. The described fix cancels the queued SR-IOV re-enable work on timeout before the reset worker's stack frame unwinds.