CVE-2026-93162: crypto: qat - cancel work on re-enable SR-IOV timeout
In the Linux kernel, the following vulnerability has been resolved:
crypto: qat - cancel work on re-enable SR-IOV timeout
The QAT reset worker queues SR-IOV reenable work using a workstruct and completion embedded in an on-stack adfsriovdevdata. If the completion wait times out, the reset worker can return while devicesriovwq still holds or executes the stack-backed work item.
Cancel the work on the devicesriovwq on timeout before the stack frame unwinds.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.110 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.52 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Compensating control
Cancel the SR-IOV re-enable work queued on device_sriov_wq when the completion wait times out, before the reset worker returns and the stack-backed adf_sriov_dev_data unwinds.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel QAT crypto driver with SR-IOV re-enable activity during a QAT reset are exposed. The issue specifically involves the reset worker and the device SR-IOV workqueue.
What condition is required to trigger the vulnerability?
The wait for SR-IOV re-enable completion must time out while the queued re-enable work is still held or executed by device_sriov_wq. The reset worker can then return and unwind the stack frame containing the work item and completion.
What is the mitigation if the fix cannot be applied immediately?
No workaround is provided in the available data. The described fix cancels the queued SR-IOV re-enable work on timeout before the reset worker's stack frame unwinds.