CVE-2026-64438

{"id": "CVE-2026-64438", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64438", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:40:43.590817Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.0}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "lessThan": "218c2836b3987f3fa1d9eac505462cded0821e4c", "versionType": "git"}, {"status": "affected", "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "lessThan": "446b4d77599cf1a168573f7fb32a4a6aa4f09219", "versionType": "git"}, {"status": "affected", "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "lessThan": "5d916c1eae1933511a69bffe243b4ee5d7da399c", "versionType": "git"}, {"status": "affected", "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "lessThan": "f344a369d0380d54c8d6c8d24734a78dd5a89817", "versionType": "git"}, {"status": "affected", "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "lessThan": "51144032248cc4ea22917370565650670b8b4e9b", "versionType": "git"}, {"status": "affected", "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "lessThan": "49cd5ac6de8de39a14ead609bb552d372d5602cd", "versionType": "git"}, {"status": "affected", "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "lessThan": "6e92b28cd74fa433658efeadf21b9d4b01023d7d", "versionType": "git"}, {"status": "affected", "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273", "lessThan": "277281c10c63791067d24d421f7c43a15faa9096", "versionType": "git"}], "programFiles": ["drivers/crypto/intel/qat/qat_common/adf_accel_devices.h", "drivers/crypto/intel/qat/qat_common/adf_common_drv.h", "drivers/crypto/intel/qat/qat_common/adf_isr.c", "drivers/crypto/intel/qat/qat_common/adf_sriov.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.3"}, {"status": "unaffected", "version": "0", "lessThan": "4.3", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.261", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.212", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.178", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.145", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.97", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.4", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/crypto/intel/qat/qat_common/adf_accel_devices.h", "drivers/crypto/intel/qat/qat_common/adf_common_drv.h", "drivers/crypto/intel/qat/qat_common/adf_isr.c", "drivers/crypto/intel/qat/qat_common/adf_sriov.c"], "defaultStatus": "affected"}]}], "published": "2026-07-25T10:17:28.303", "references": [{"url": "https://git.kernel.org/stable/c/218c2836b3987f3fa1d9eac505462cded0821e4c", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/277281c10c63791067d24d421f7c43a15faa9096", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/446b4d77599cf1a168573f7fb32a4a6aa4f09219", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/49cd5ac6de8de39a14ead609bb552d372d5602cd", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/51144032248cc4ea22917370565650670b8b4e9b", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5d916c1eae1933511a69bffe243b4ee5d7da399c", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/6e92b28cd74fa433658efeadf21b9d4b01023d7d", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f344a369d0380d54c8d6c8d24734a78dd5a89817", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-416"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - fix VF2PF work teardown race in adf_disable_sriov()\n\nThe VF2PF interrupt handler queues PF-side response work that stores a\nraw pointer to per-VF state (struct adf_accel_vf_info). Currently,\nadf_disable_sriov() destroys per-VF mutexes and frees vf_info without\nstopping new VF2PF work or waiting for in-flight workers to complete. A\nconcurrently scheduled or already queued worker can then dereference\nfreed memory.\n\nThis manifests as a use-after-free when KASAN is enabled:\n\n BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0\n Write of size 8 at addr 0000000000000260 by task kworker/24:2/...\n Workqueue: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat]\n Call Trace:\n kasan_report+0x119/0x140\n mutex_lock+0x76/0xe0\n adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat]\n adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat]\n adf_iov_send_resp+0x8c/0xe0 [intel_qat]\n process_one_work+0x6ac/0xfd0\n worker_thread+0x4dd/0xd30\n kthread+0x326/0x410\n ret_from_fork+0x33b/0x670\n\nAdd a PF-local flag, vf2pf_disabled, that gates work queueing, worker\nprocessing, and interrupt re-enabling during teardown. Set this flag\natomically with the hardware interrupt mask inside\nadf_disable_all_vf2pf_interrupts(). After masking, synchronize the AE\ncluster MSI-X interrupt and flush the PF response workqueue before\ntearing down per-VF locks and state so all in-flight work completes\nbefore vf_info is destroyed.\n\nIntroduce adf_enable_all_vf2pf_interrupts() to clear the flag and\nunmask all VF2PF interrupts under the same lock when SR-IOV is\nre-enabled. This ensures the software flag and hardware state transition\natomically on both the enable and disable paths."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncrypto: qat - correcci\u00f3n de la condici\u00f3n de carrera en la deshabilitaci\u00f3n del trabajo VF2PF en adf_disable_sriov()\n\nEl gestor de interrupciones VF2PF encola trabajo de respuesta del lado del PF que almacena un puntero sin procesar al estado por VF (struct adf_accel_vf_info). Actualmente, adf_disable_sriov() destruye los mutexes por VF y libera vf_info sin detener nuevo trabajo VF2PF o esperar a que los trabajadores en curso se completen. Un trabajador programado concurrentemente o ya encolado puede entonces desreferenciar memoria liberada.\n\nEsto se manifiesta como un uso despu\u00e9s de liberaci\u00f3n cuando KASAN est\u00e1 habilitado:\n\n ERROR: KASAN: null-ptr-deref en mutex_lock+0x76/0xe0\n Escritura de tama\u00f1o 8 en la direcci\u00f3n 0000000000000260 por la tarea kworker/24:2/...\n Cola de trabajo: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat]\n Rastro de Llamada:\n kasan_report+0x119/0x140\n mutex_lock+0x76/0xe0\n adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat]\n adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat]\n adf_iov_send_resp+0x8c/0xe0 [intel_qat]\n process_one_work+0x6ac/0xfd0\n worker_thread+0x4dd/0xd30\n kthread+0x326/0x410\n ret_from_fork+0x33b/0x670\n\nSe a\u00f1ade un indicador local de PF, vf2pf_disabled, que controla el encolamiento de trabajo, el procesamiento de trabajadores y la re-habilitaci\u00f3n de interrupciones durante la deshabilitaci\u00f3n. Este indicador se establece at\u00f3micamente con la m\u00e1scara de interrupci\u00f3n de hardware dentro de adf_disable_all_vf2pf_interrupts(). Despu\u00e9s de enmascarar, se sincroniza la interrupci\u00f3n MSI-X del cl\u00faster AE y se vac\u00eda la cola de trabajo de respuesta del PF antes de deshabilitar los bloqueos y el estado por VF para que todo el trabajo en curso se complete antes de que vf_info sea destruido.\n\nSe introduce adf_enable_all_vf2pf_interrupts() para borrar el indicador y desenmascarar todas las interrupciones VF2PF bajo el mismo bloqueo cuando SR-IOV es re-habilitado. Esto asegura que el indicador de software y el estado del hardware transicionen at\u00f3micamente tanto en las rutas de habilitaci\u00f3n como de deshabilitaci\u00f3n."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "797E695E-C99E-4F7E-AC6C-38D5378E6A9B", "versionEndExcluding": "5.10.261", "versionStartIncluding": "4.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8E99FB01-CD93-41AF-A653-3F450652B9A6", "versionEndExcluding": "5.15.212", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "092233C7-F4E0-40C8-BD4D-A28FE50DFE20", "versionEndExcluding": "6.1.178", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7046B092-F810-4440-ACE6-60218518EECE", "versionEndExcluding": "6.6.145", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "05880CF6-5AD2-44E9-853A-6CE8318E76A5", "versionEndExcluding": "6.12.97", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "67D87928-1419-4529-9201-42C059678CB4", "versionEndExcluding": "6.18.40", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42", "versionEndExcluding": "7.1.4", "versionStartIncluding": "6.19"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}