SB20260727273 - Use-after-free in Linux kernel qat qat_common driver

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-64305)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the qat service_table list handling in adf_init.c when iterating over registered services during device lifecycle and notification operations. A local user can trigger concurrent service registration or unregistration during list traversal to cause a denial of service.

The issue can also lead to list corruption during concurrent access.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0dbcecea740d943002c1cbdafa39bdfc108e32a5
• https://git.kernel.org/stable/c/222fa7b453b612f4407f260146d89a2ce2bc831d
• https://git.kernel.org/stable/c/5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e
• https://git.kernel.org/stable/c/c3c5925791cff3b84d313293fd60f384d877d793