CVE-2026-64438 Overview
CVE-2026-64438 is a use-after-free vulnerability in the Linux kernel's Intel QuickAssist Technology (QAT) cryptographic driver. The flaw resides in the adf_disable_sriov() teardown path, where the VF2PF (Virtual Function to Physical Function) interrupt handler queues response work referencing per-VF state. During SR-IOV teardown, the driver destroys per-VF mutexes and frees adf_accel_vf_info structures without stopping new VF2PF work or waiting for in-flight workers to finish. A concurrently queued worker can then dereference freed memory, producing a kernel use-after-free.
Critical Impact
A local attacker with access to a VF or the ability to trigger SR-IOV teardown races can cause kernel memory corruption, leading to denial of service or potential privilege escalation.
Affected Products
- Linux kernel builds shipping the intel_qat driver with SR-IOV support
- Systems using Intel QuickAssist Technology accelerators with virtual functions enabled
- Distributions that have not backported the fix commits listed in the kernel.org stable tree
Discovery Timeline
- 2026-07-25 - CVE-2026-64438 published to NVD
- 2026-07-27 - Last updated in NVD database
Technical Details for CVE-2026-64438
Vulnerability Analysis
The Intel QAT driver processes VF2PF messages through a workqueue named qat_pf2vf_resp_wq. When a VF sends a message, the PF-side interrupt handler queues a worker that stores a raw pointer to the corresponding struct adf_accel_vf_info. This structure holds per-VF locks and state used to compose the response.
During SR-IOV disable, adf_disable_sriov() proceeds to destroy per-VF mutexes and free vf_info without first quiescing the VF2PF path. Two race windows exist. First, an interrupt arriving during teardown can queue a new worker after the state has begun to be released. Second, an already-queued worker can execute and call mutex_lock() on a mutex that has just been destroyed and memory that has just been freed.
When Kernel Address Sanitizer (KASAN) is enabled, the condition surfaces as a null-pointer dereference inside mutex_lock+0x76/0xe0, invoked from adf_gen4_pfvf_send and adf_recv_and_handle_vf2pf_msg within the intel_qat module.
Root Cause
The root cause is missing synchronization between hardware interrupt masking, workqueue flushing, and per-VF state destruction. The teardown path does not atomically mark VF2PF processing as disabled, and it does not wait for in-flight workers to complete before freeing the memory those workers reference.
Attack Vector
Exploitation requires local access and low privileges on a host running the vulnerable QAT driver with SR-IOV enabled. An attacker who can trigger or influence SR-IOV disable operations while VF2PF traffic is active can race the teardown to cause the kernel to dereference freed memory. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H reflects a scope change because kernel memory corruption can affect components beyond the vulnerable driver.
No public proof-of-concept is available. The vulnerability manifests reliably under KASAN when SR-IOV teardown occurs concurrently with VF2PF message traffic. See the kernel commits referenced below for technical implementation details.
Detection Methods for CVE-2026-64438
Indicators of Compromise
- KASAN reports of the form BUG: KASAN: null-ptr-deref in mutex_lock originating from the qat_pf2vf_resp_wq workqueue
- Kernel oops or panic entries referencing adf_iov_send_resp, adf_recv_and_handle_vf2pf_msg, or adf_gen4_pfvf_send in the intel_qat module
- Unexpected kernel crashes correlated with SR-IOV disable operations on QAT devices
Detection Strategies
- Enable KASAN on test and staging kernels to surface the use-after-free deterministically during SR-IOV stress tests
- Audit installed kernel versions against the fixed commits (218c2836, 277281c1, 446b4d77, 49cd5ac6, 51144032, 5d916c1e, 6e92b28c, f344a369) in the stable tree
- Monitor dmesg and journald for intel_qat stack traces following VF configuration changes
Monitoring Recommendations
- Forward kernel logs from QAT-enabled hosts to a centralized log platform and alert on intel_qat fault signatures
- Track SR-IOV lifecycle events on hypervisors that expose QAT VFs to guests or containers
- Correlate crash telemetry with VF creation, deletion, and reset operations
How to Mitigate CVE-2026-64438
Immediate Actions Required
- Apply the upstream kernel fix or the vendor-supplied backport for CVE-2026-64438 as soon as it is available for your distribution
- Restrict local access on systems exposing QAT VFs and limit which accounts can perform SR-IOV administrative operations
- Avoid runtime toggling of SR-IOV on production QAT devices while workloads are actively using VF2PF messaging
Patch Information
The fix introduces a PF-local vf2pf_disabled flag that gates work queueing, worker processing, and interrupt re-enabling. adf_disable_all_vf2pf_interrupts() sets the flag atomically with the hardware interrupt mask, then synchronizes the AE cluster MSI-X interrupt and flushes the PF response workqueue before per-VF state is destroyed. A new adf_enable_all_vf2pf_interrupts() clears the flag and unmasks interrupts under the same lock when SR-IOV is re-enabled. The corrective commits are available in the kernel.org stable tree: Commit 218c2836, Commit 277281c1, Commit 446b4d77, Commit 49cd5ac6, Commit 51144032, Commit 5d916c1e, Commit 6e92b28c, and Commit f344a369.
Workarounds
- Unload the intel_qat module on systems that do not require hardware crypto acceleration until a patched kernel is deployed
- Disable SR-IOV on affected QAT devices to prevent VF2PF message traffic and eliminate the race window
- Restrict administrative operations that trigger sriov_numvfs transitions to trusted maintenance windows
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
