Use-after-free in Linux kernel - CVE-2026-64438
Published: July 27, 2026
Vulnerability identifier: #VU139501
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-64438
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in the VF2PF response workqueue handling in the intel_qat SR-IOV implementation when processing VF2PF messages during SR-IOV teardown. A local user can trigger concurrent VF2PF work so that a queued or in-flight worker dereferences freed per-VF state to cause a denial of service.
The issue occurs because PF-side response work stores a raw pointer to per-VF state that may be freed by adf_disable_sriov() before queued work completes.
How to mitigate CVE-2026-64438
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/218c2836b3987f3fa1d9eac505462cded0821e4c
- https://git.kernel.org/stable/c/277281c10c63791067d24d421f7c43a15faa9096
- https://git.kernel.org/stable/c/446b4d77599cf1a168573f7fb32a4a6aa4f09219
- https://git.kernel.org/stable/c/49cd5ac6de8de39a14ead609bb552d372d5602cd
- https://git.kernel.org/stable/c/51144032248cc4ea22917370565650670b8b4e9b
- https://git.kernel.org/stable/c/5d916c1eae1933511a69bffe243b4ee5d7da399c
- https://git.kernel.org/stable/c/6e92b28cd74fa433658efeadf21b9d4b01023d7d
- https://git.kernel.org/stable/c/f344a369d0380d54c8d6c8d24734a78dd5a89817