CVE-2025-30508: Intel QAT Denial of Service Vulnerability

CVE-2025-30508 Overview

CVE-2025-30508 is an improper authorization vulnerability [CWE-285] affecting Intel(R) Quick Assist Technology (QAT) on certain Intel platforms. The flaw resides within Ring 0 (kernel mode) and may allow an authenticated, unprivileged local user to trigger a denial of service condition. Intel disclosed the issue in security advisory SA-01406.

The vulnerability impacts only availability. It does not affect confidentiality or integrity of the host system. Exploitation requires local access, low attack complexity, and no user interaction.

Critical Impact
An authenticated local attacker can disrupt kernel-mode QAT functionality, causing denial of service on affected Intel platforms running vulnerable QAT drivers.

Affected Products

Intel(R) Quick Assist Technology (QAT) software for select Intel platforms
Kernel-mode (Ring 0) QAT driver components
Refer to Intel Security Advisory SA-01406 for the full list of affected versions

Discovery Timeline

2026-02-10 - CVE-2025-30508 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-30508

Vulnerability Analysis

Intel Quick Assist Technology is a hardware acceleration platform for cryptographic and compression workloads. The QAT software stack exposes kernel-mode interfaces (Ring 0) used by privileged drivers and userland clients through controlled entry points. CVE-2025-30508 stems from improper authorization checks within these kernel components.

An authenticated user with no special privileges can interact with the affected kernel pathway. Because the component fails to enforce authorization correctly, the attacker can issue requests that should be rejected. The result is a denial of service affecting QAT-dependent workloads and potentially the surrounding kernel context.

The issue carries an EPSS score of 0.018%, indicating no observed in-the-wild exploitation at this time. No public proof-of-concept code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is missing or insufficient authorization enforcement [CWE-285] in a Ring 0 QAT code path. The kernel component does not adequately verify that the requesting principal holds the required privileges before performing a sensitive operation. This permits an unprivileged caller to reach logic that should be restricted to higher-privileged contexts.

Attack Vector

The attack vector is local. An adversary must already hold authenticated access to the target system with low privileges. From this position, the attacker invokes the vulnerable QAT kernel interface to trigger the denial of service. No user interaction is required, and the attack complexity is low.

The vulnerability is described in prose only because no verified exploit code is publicly available. See the Intel Security Advisory SA-01406 for vendor-supplied technical details.

Detection Methods for CVE-2025-30508

Indicators of Compromise

Unexpected crashes, hangs, or restarts of QAT kernel driver components on affected Intel platforms
Kernel log entries referencing QAT subsystems failing or terminating unexpectedly
Service interruption in cryptographic or compression workloads accelerated by QAT

Detection Strategies

Monitor kernel logs (dmesg, journalctl -k, Windows Event Log) for QAT driver faults and abnormal terminations
Correlate denial of service symptoms with recent local process activity from unprivileged users
Inventory systems running Intel QAT software and compare installed versions against those listed in Intel SA-01406

Monitoring Recommendations

Track QAT device availability and throughput as health metrics on affected hosts
Alert on repeated kernel-mode faults associated with QAT modules within a short time window
Collect endpoint telemetry on local process executions that interact with QAT device nodes and kernel interfaces

How to Mitigate CVE-2025-30508

Immediate Actions Required

Identify all systems running Intel Quick Assist Technology software using asset inventory data
Apply the updated QAT software release listed in Intel Security Advisory SA-01406 as soon as it is validated for your environment
Restrict local interactive and shell access on affected hosts to trusted administrators

Patch Information

Intel has published guidance and fixed software versions in Intel Security Advisory SA-01406. Administrators should consult the advisory to obtain the patched QAT driver and software stack versions appropriate for their platform, then deploy them through standard change-management processes.

Workarounds

Limit local logon rights on systems running vulnerable QAT components until patches are applied
Disable or unload the QAT kernel driver on hosts that do not require hardware acceleration, where operationally feasible
Segment workloads that depend on QAT onto hardened hosts with stricter access controls

bash

# Example: verify QAT driver presence and version on Linux
lsmod | grep -i qat
modinfo qat_4xxx | grep -E 'version|filename'
# Restrict access to QAT device nodes to a privileged group
chgrp qat-admins /dev/qat_adf_ctl
chmod 660 /dev/qat_adf_ctl