{"id":"CVE-2026-64438","summary":"crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - fix VF2PF work teardown race in adf_disable_sriov()\n\nThe VF2PF interrupt handler queues PF-side response work that stores a\nraw pointer to per-VF state (struct adf_accel_vf_info). Currently,\nadf_disable_sriov() destroys per-VF mutexes and frees vf_info without\nstopping new VF2PF work or waiting for in-flight workers to complete. A\nconcurrently scheduled or already queued worker can then dereference\nfreed memory.\n\nThis manifests as a use-after-free when KASAN is enabled:\n\n  BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0\n  Write of size 8 at addr 0000000000000260 by task kworker/24:2/...\n  Workqueue: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat]\n  Call Trace:\n    kasan_report+0x119/0x140\n    mutex_lock+0x76/0xe0\n    adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat]\n    adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat]\n    adf_iov_send_resp+0x8c/0xe0 [intel_qat]\n    process_one_work+0x6ac/0xfd0\n    worker_thread+0x4dd/0xd30\n    kthread+0x326/0x410\n    ret_from_fork+0x33b/0x670\n\nAdd a PF-local flag, vf2pf_disabled, that gates work queueing, worker\nprocessing, and interrupt re-enabling during teardown. Set this flag\natomically with the hardware interrupt mask inside\nadf_disable_all_vf2pf_interrupts(). After masking, synchronize the AE\ncluster MSI-X interrupt and flush the PF response workqueue before\ntearing down per-VF locks and state so all in-flight work completes\nbefore vf_info is destroyed.\n\nIntroduce adf_enable_all_vf2pf_interrupts() to clear the flag and\nunmask all VF2PF interrupts under the same lock when SR-IOV is\nre-enabled. This ensures the software flag and hardware state transition\natomically on both the enable and disable paths.","modified":"2026-07-28T04:03:05.812865564Z","published":"2026-07-25T08:51:11.740Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64438.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/218c2836b3987f3fa1d9eac505462cded0821e4c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/277281c10c63791067d24d421f7c43a15faa9096"},{"type":"WEB","url":"https://git.kernel.org/stable/c/446b4d77599cf1a168573f7fb32a4a6aa4f09219"},{"type":"WEB","url":"https://git.kernel.org/stable/c/49cd5ac6de8de39a14ead609bb552d372d5602cd"},{"type":"WEB","url":"https://git.kernel.org/stable/c/51144032248cc4ea22917370565650670b8b4e9b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5d916c1eae1933511a69bffe243b4ee5d7da399c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6e92b28cd74fa433658efeadf21b9d4b01023d7d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f344a369d0380d54c8d6c8d24734a78dd5a89817"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64438.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64438"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"ed8ccaef52fa03fb03cff45b380f72c9f869f273"},{"fixed":"218c2836b3987f3fa1d9eac505462cded0821e4c"},{"fixed":"446b4d77599cf1a168573f7fb32a4a6aa4f09219"},{"fixed":"5d916c1eae1933511a69bffe243b4ee5d7da399c"},{"fixed":"f344a369d0380d54c8d6c8d24734a78dd5a89817"},{"fixed":"51144032248cc4ea22917370565650670b8b4e9b"},{"fixed":"49cd5ac6de8de39a14ead609bb552d372d5602cd"},{"fixed":"6e92b28cd74fa433658efeadf21b9d4b01023d7d"},{"fixed":"277281c10c63791067d24d421f7c43a15faa9096"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64438.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"5.10.261"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.212"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.178"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.145"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.97"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.40"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64438.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}