CVE-2026-64529: Linux Kernel QAT Driver Vulnerability

CVE-2026-64529 Overview

CVE-2026-64529 affects the Intel QuickAssist Technology (QAT) driver in the Linux kernel. The QAT driver exposed a character device (qat_adf_ctl) with IOCTLs for device configuration, start, stop, status query, and enumeration. These IOCTLs were not part of any public uAPI header and had no known in-tree or out-of-tree users, yet they expanded the local attack surface of the kernel. Upstream maintainers resolved the issue by removing the character device, the IOCTL definitions, and related data structures. Device lifecycle management now relies on sysfs instead.

Critical Impact
A local attacker with access to the QAT character device could interact with IOCTL handlers that have been the subject of multiple bug reports, potentially leading to high impact on confidentiality, integrity, and availability.

Affected Products

Linux kernel versions containing the QAT (qat) crypto driver with the qat_adf_ctl character device
Systems using Intel QuickAssist Technology accelerators through the in-tree QAT driver
Distributions shipping vulnerable kernels prior to the fix commits referenced in kernel.org stable trees

Discovery Timeline

2026-07-25 - CVE-2026-64529 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64529

Vulnerability Analysis

The Linux kernel QAT crypto driver registered a character device named qat_adf_ctl that exposed IOCTL handlers for administrative operations on QAT accelerators. The exposed operations covered device configuration, start, stop, status query, and enumeration. Because the interface was not documented in any public uAPI header, it lacked the review scrutiny normally applied to kernel/user boundaries.

The IOCTL code paths accepted user-supplied configuration blobs and identifiers through structures such as adf_dev_status_info, adf_user_cfg_key_val, adf_user_cfg_section, and adf_user_cfg_ctl_data. These paths have been the subject of multiple bug reports and represent unnecessary attack surface, since device lifecycle is already managed via sysfs.

A local user with the ability to open the QAT control device could invoke these IOCTL handlers. Successful exploitation of latent bugs in the removed code could impact confidentiality, integrity, and availability of the host.

Root Cause

The root cause is unused legacy kernel/user interface code that persisted in the driver without active consumers. Dead IOCTL paths in adf_ctl_drv.c and helpers such as adf_cfg_del_all(), adf_devmgr_verify_id(), adf_devmgr_get_num_dev(), adf_devmgr_get_dev_by_id(), and adf_get_vf_real_id() remained reachable from userspace. This qualifies as a kernel driver vulnerability rooted in unnecessary attack surface exposure.

Attack Vector

Exploitation requires local access to the target system and permission to open the QAT character device. No user interaction is required. The attacker sends crafted IOCTL requests to trigger flaws in the parsing and configuration logic. The fix removes the character device entirely, along with the adf_cfg_user.h header and the QAT entry in ioctl-number.rst.

No synthetic exploitation code is provided. Refer to the upstream commits linked in the references for the exact code paths removed.

Detection Methods for CVE-2026-64529

Indicators of Compromise

Presence of the /dev/qat_adf_ctl character device on a running kernel, indicating an unpatched QAT driver
Unexpected local processes opening the QAT control device outside of legitimate administrative tooling
Kernel log entries from the QAT driver referencing IOCTL configuration paths on hosts where such tooling is not deployed

Detection Strategies

Inventory kernel versions across Linux hosts and flag those running QAT-enabled kernels prior to the fix commits (for example, 071590a, 1de076f, 3ae49dd, 6848a6e)
Audit /dev entries during host baselining to detect the legacy qat_adf_ctl device node
Monitor ioctl syscall activity from non-root processes targeting QAT device file descriptors using eBPF or auditd rules

Monitoring Recommendations

Enable Linux auditd rules on open and ioctl syscalls against /dev/qat_adf_ctl to record any local interaction
Track privilege boundary crossings and unexpected root escalations on hosts that expose QAT accelerators
Correlate kernel driver telemetry with process ancestry to identify unauthorized access attempts to the control device

How to Mitigate CVE-2026-64529

Immediate Actions Required

Update to a Linux kernel version that includes the upstream fix removing qat_adf_ctl and the associated IOCTLs
Restrict local user access on hosts equipped with Intel QAT accelerators until patches are deployed
Verify that administrative tooling for QAT devices uses sysfs interfaces rather than the deprecated character device

Patch Information

The fix is distributed across multiple upstream and stable kernel commits: Kernel Git Commit 071590a, Kernel Git Commit 1de076f, Kernel Git Commit 3ae49dd, Kernel Git Commit 6848a6e, Kernel Git Commit a499966, Kernel Git Commit b1ea970, Kernel Git Commit b8ebf00, Kernel Git Commit d237230, and Kernel Git Commit de2cc38. Consult your distribution vendor for backported packages.

Workarounds

Tighten permissions on /dev/qat_adf_ctl so that only trusted administrative accounts can open the device on unpatched hosts
Unload the QAT driver on systems that do not require hardware acceleration until a patched kernel is installed
Enforce mandatory access control policies (SELinux or AppArmor) restricting the set of processes able to invoke IOCTLs on QAT device nodes

bash

# Verify presence of the legacy QAT control device and driver module
ls -l /dev/qat_adf_ctl 2>/dev/null && echo "Legacy QAT control device present - patch required"
lsmod | grep -E '^(intel_qat|qat_)'
uname -r