CVE-2026-64305: crypto: qat - protect service table iterations with service_lock

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-25 · updated 2026-10-30
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - protect service table iterations with service_lock The service_table list is protected by service_lock when entries are added or removed (in adf_service_add() and adf_service_remove()), but several functions iterate over the list without holding this lock. A concurrent adf_service_register() or adf_service_unregister() call could modify the list during traversal, leading to list corruption or a use-after-free. Fix this by holding service_lock across all list_for_each_entry() iterations of service_table in adf_dev_init(), adf_dev_start(), adf_dev_stop(), adf_dev_shutdown(), adf_dev_restarting_notify(), adf_dev_restarted_notify(), and adf_error_notifier(). The lock ordering is safe: callers of the static helpers (adf_dev_up() and adf_dev_down()) acquire state_lock before service_lock, and no event_hld callback or service_lock holder ever acquires state_lock in the reverse order.

Affected products

Linux kernel: from 3.17 before 6.12.96; from 6.13 before 6.18.39; from 6.19 before 7.1.4 — fixed in 6.12.96, 6.18.39, 7.1.4
Linux: 3.17 — fixed in 7.2

How to fix

Upgrade to a fixed version: Linux kernel 6.12.96, 6.18.39, 7.1.4; Linux 7.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-64305 or the next vulnerability affects your stack