CVE-2026-46060: Linux Kernel Race Condition Vulnerability

CVE-2026-46060 Overview

CVE-2026-46060 is a Linux kernel vulnerability in the Intel QuickAssist Technology (QAT) cryptographic accelerator driver for 6xxx devices. The flaw stems from improper interrupt request (IRQ) cleanup ordering when the device probe path fails partway through initialization. When adf_dev_up() partially completes and then fails, IRQ handlers registered during adf_isr_resource_alloc() remain attached while MSI-X vectors are released by devres. This results in kernel warnings such as remove_proc_entry: removing non-empty directory 'irq/143', leaking at least 'qat0-bundle0' and leaks proc entries tied to active IRQ lines. The fix calls adf_dev_down() explicitly when adf_dev_up() fails, ensuring IRQ handlers are detached before devres releases MSI-X vectors.

Critical Impact
Failed initialization of QAT 6xxx cryptographic accelerator devices leaks IRQ handler proc entries and can leave kernel state inconsistent, contributing to resource leaks and stability issues on affected systems.

Affected Products

Linux kernel with the crypto: qat driver supporting Intel QAT 6xxx devices
Stable kernel branches referenced by upstream fix commits 27f561b, 7cd651f, and 95aed2a
Systems using pcim_enable_device() with QAT MSI-X interrupt allocation

Discovery Timeline

2026-05-27 - CVE-2026-46060 published to the National Vulnerability Database
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46060

Vulnerability Analysis

The vulnerability lives in the Intel QAT driver's probe and teardown logic for 6xxx series cryptographic accelerators. The driver uses managed PCI device APIs through pcim_enable_device(), which causes the kernel to register cleanup callbacks via the device-managed resources (devres) framework. When pci_alloc_irq_vectors() is called, the kernel internally registers pcim_msi_release() as a devres action. This action will later call pci_free_irq_vectors() to tear down MSI-X vectors. The issue manifests when adf_dev_up() partially succeeds, leaving IRQ handlers like qat0-bundle0 attached, and then fails before completing the rest of initialization.

Root Cause

Devres callbacks execute in last-in-first-out (LIFO) order during cleanup. Because pcim_msi_release() is registered inside adf_dev_up() after the device-managed action that would invoke adf_device_down(), the MSI-X vectors are released before the IRQ handlers are detached. The kernel's IRQ subsystem then triggers remove_proc_entry() against /proc/irq/<n> directories that still hold references to live handlers, producing the leak warning and orphaned proc entries. Reordering the devm_add_action_or_reset() call does not resolve the issue because LIFO ordering still places pcim_msi_release() first.

Attack Vector

This is a local kernel reliability flaw rather than a remotely exploitable vulnerability. Triggering the buggy code path requires a probe-time failure on a system with a QAT 6xxx device present. Conditions that can induce partial adf_dev_up() failure include firmware loading errors, configuration parsing failures, or resource allocation issues during driver initialization. No exploit code is publicly available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

The vulnerability mechanism is described in prose only because no verified proof-of-concept code exists. See the upstream commits for the exact patch implementation.

Detection Methods for CVE-2026-46060

Indicators of Compromise

Kernel log messages matching remove_proc_entry: removing non-empty directory 'irq/<num>', leaking at least 'qat0-bundle<n>'
Probe failure messages from the qat_6xxx driver followed by warnings about MSI-X teardown
Orphaned entries under /proc/irq/ referencing qat0-bundle* handlers after driver unload

Detection Strategies

Monitor dmesg and journalctl -k output for QAT probe failure sequences combined with remove_proc_entry warnings
Audit running kernel versions on systems equipped with Intel QAT 6xxx accelerators against the patched stable releases
Use kernel WARN_ON tracepoints and crash dump analysis to identify systems hitting the buggy cleanup path

Monitoring Recommendations

Forward kernel ring buffer events to a centralized logging platform and alert on QAT driver probe failures
Inventory hosts using QAT 6xxx hardware for crypto offload and track their kernel patch level
Track devres-related warnings in kernel telemetry as a signal of latent driver lifecycle bugs

How to Mitigate CVE-2026-46060

Immediate Actions Required

Apply the upstream kernel patch referenced by commits 27f561b, 7cd651f, and 95aed2a from the stable tree
Update affected systems to a kernel build that includes the explicit adf_dev_down() call on adf_dev_up() failure
Reboot systems running QAT 6xxx workloads after patching to ensure the corrected driver is loaded

Patch Information

The fix calls adf_dev_down() explicitly when adf_dev_up() fails, freeing IRQ handlers before devres releases the MSI-X vectors. Patches are available in the upstream stable kernel tree. Reference: Kernel Git Commit 27f561b, Kernel Git Commit 7cd651f, and Kernel Git Commit 95aed2a.

Workarounds

Blacklist the qat_6xxx kernel module on systems where QAT acceleration is not required until a patched kernel is deployed
Avoid driver reloading and probe retries on production hosts running unpatched kernels with QAT 6xxx hardware
Validate firmware and device configuration prior to driver load to reduce the chance of partial adf_dev_up() failures

bash

# Prevent the qat_6xxx driver from loading until kernel is patched
echo 'blacklist qat_6xxx' | sudo tee /etc/modprobe.d/blacklist-qat6xxx.conf
sudo update-initramfs -u

# Verify running kernel version after patching
uname -r