CVE-2026-64305 Overview
CVE-2026-64305 is a race condition in the Linux kernel's Intel QuickAssist Technology (QAT) crypto driver. The service_table list is protected by service_lock during add and remove operations, but several driver functions iterate the list without acquiring the lock. A concurrent adf_service_register() or adf_service_unregister() call can modify the list during traversal, resulting in list corruption or a use-after-free condition in kernel memory.
Critical Impact
Concurrent modification of the QAT service_table during unlocked traversal can corrupt kernel list structures and trigger use-after-free conditions, threatening kernel stability and integrity.
Affected Products
- Linux kernel builds containing the crypto/qat driver with adf_service_add() and adf_service_remove() functions
- Systems using Intel QuickAssist Technology (QAT) hardware acceleration
- Distributions shipping affected upstream kernel versions prior to the referenced stable commits
Discovery Timeline
- 2026-07-25 - CVE-2026-64305 published to the National Vulnerability Database
- 2026-07-25 - Last updated in NVD database
Technical Details for CVE-2026-64305
Vulnerability Analysis
The flaw resides in the Intel QAT crypto driver within the Linux kernel. The service_table linked list tracks registered acceleration services. Functions such as adf_dev_init(), adf_dev_start(), adf_dev_stop(), adf_dev_shutdown(), adf_dev_restarting_notify(), adf_dev_restarted_notify(), and adf_error_notifier() walk this list using list_for_each_entry() without holding service_lock.
Meanwhile, adf_service_add() and adf_service_remove() acquire service_lock when mutating the list. This asymmetric locking creates a classic read/write race. If adf_service_register() or adf_service_unregister() runs concurrently with any traversal, the iterator can dereference a freed or partially unlinked entry.
The upstream fix wraps every affected list_for_each_entry() call with service_lock. The patch documents that the lock ordering remains safe because callers like adf_dev_up() and adf_dev_down() acquire state_lock before service_lock, and no event_hld callback reverses that order.
Root Cause
The root cause is inconsistent synchronization on a shared kernel data structure. Writers acquired service_lock but readers did not, violating the invariant that list traversal must exclude concurrent structural modification. This is a Race Condition [CWE-362] combined with potential Use-After-Free [CWE-416] behavior.
Attack Vector
Triggering the race requires local code paths that can invoke QAT service registration or device lifecycle operations concurrently. The published advisory does not describe a remote attack vector, and no public exploit is available. See the Kernel Git Commit c3c59257 for the exact code change.
No verified code examples are available. Refer to the referenced stable kernel commits for the precise diff and affected call sites.
Detection Methods for CVE-2026-64305
Indicators of Compromise
- Kernel log entries referencing list corruption, such as list_add corruption or list_del corruption in dmesg on hosts using QAT
- Kernel oops or panic traces originating in adf_dev_init, adf_dev_start, adf_dev_stop, adf_dev_shutdown, or QAT notifier callbacks
- Unexpected crashes on systems that dynamically load or unload QAT service modules under load
Detection Strategies
- Inventory running kernel versions against the fixed commits referenced in the kernel.org stable tree to identify unpatched hosts
- Correlate kernel crash telemetry with QAT driver stack frames to surface likely race triggers
- Enable CONFIG_DEBUG_LIST in test builds to catch list corruption earlier during validation
Monitoring Recommendations
- Forward dmesg and /var/log/kern.log to a centralized log platform and alert on QAT-related oops or WARN traces
- Track kernel package versions across the fleet to confirm patch deployment status
- Monitor QAT-enabled hosts for abnormal reboot rates that may indicate exploitation attempts or unstable driver behavior
How to Mitigate CVE-2026-64305
Immediate Actions Required
- Identify all hosts running QAT-enabled workloads such as IPsec, TLS termination, or compression offload
- Apply the upstream stable kernel patches referenced below at the next available maintenance window
- Restrict local access on affected hosts to reduce the population of actors able to trigger concurrent QAT service operations
Patch Information
The fix is available in the Linux stable tree via commits 0dbcecea, 222fa7b4, 5c6f845e, and c3c59257. Update to a distribution kernel that includes these commits.
Workarounds
- Disable the QAT driver (intel_qat, qat_* modules) on hosts that do not require hardware crypto acceleration until patches are applied
- Avoid dynamic loading or unloading of QAT service modules on production systems running unpatched kernels
- Serialize administrative operations that trigger QAT device lifecycle changes to reduce concurrency exposure
# Verify whether QAT modules are loaded and consider unloading on unpatched hosts
lsmod | grep -E 'qat|intel_qat'
# If QAT is not required, prevent auto-load
echo 'blacklist intel_qat' | sudo tee /etc/modprobe.d/blacklist-qat.conf
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
