Use-after-free in Linux kernel - CVE-2026-64305

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the qat service_table list handling in adf_init.c when iterating over registered services during device lifecycle and notification operations. A local user can trigger concurrent service registration or unregistration during list traversal to cause a denial of service.

The issue can also lead to list corruption during concurrent access.

Affected software

How to mitigate CVE-2026-64305

External References

• https://git.kernel.org/stable/c/0dbcecea740d943002c1cbdafa39bdfc108e32a5
• https://git.kernel.org/stable/c/222fa7b453b612f4407f260146d89a2ce2bc831d
• https://git.kernel.org/stable/c/5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e
• https://git.kernel.org/stable/c/c3c5925791cff3b84d313293fd60f384d877d793

Related Security Bulletins

• Use-after-free in Linux kernel qat qat_common driver