Linux kernel Intel QAT: unlocked service_table walks can corrupt the list or use freed entries

Impact

The QAT driver's service_table list is protected by service_lock on add and remove, but adf_dev_init(), adf_dev_start(), adf_dev_stop(), adf_dev_shutdown(), the restart notifiers and adf_error_notifier() all walked it without holding that lock. A service registering or unregistering while one of those runs can corrupt the list or leave a walker dereferencing a freed entry, which on a server means a host panic during device bring-up, teardown or error recovery. This is relevant to fleets running Intel QuickAssist offload - built into recent Xeon Scalable parts and commonly surfaced to workloads through the QAT device plugin - where a crash takes the node and every GPU job on it. Be clear about reachability: both sides of the race are privileged operations (loading or unloading a QAT service module, or bringing a device up and down), so an unprivileged tenant pod cannot drive this. The vendor-supplied 7.8 local score assumes a local attacker who already holds those privileges; treat this as a stability fix for nodes that expose QAT rather than a tenant-escape.

Who can reach it

Local and privileged: something able to load or unload a QAT service module, or to start/stop a QAT device, concurrently with another CPU walking the service table. Not reachable from an unprivileged container or a tenant holding only an accelerator device node.

What to do

Pick up a stable kernel containing the listed commits and reboot each node that has QAT devices bound; the change is inside the driver, so there is no sysfs or module-parameter mitigation. Until then, avoid loading or unloading QAT service modules while devices are being brought up or torn down, and do not script QAT module reloads into node bring-up automation. Nodes with QAT disabled in BIOS or with the driver unloaded are unaffected.

References

Related entries

• Linux kernel BPF TCP iterator: double socket release on batch realloc failure panics the nodeCVE-2026-64575 · Linux kernel BPF TCP iterator (bpf_iter_tcp_batch)High
• Linux kernel (net/xfrm): Setting a per-socket IPsec policy reset the socket's destination cache non-atomically whileCVE-2026-64581 · Linux kernel (net/xfrm)High
• Linux kernel iomap: zero-length write range underflows into an out-of-bounds bitmap_set()CVE-2026-68145 · Linux kernel iomap (ifs_set_range_dirty / ifs_set_range_uptodate)High
• Linux kernel libceph: use-after-free reading the monmap debugfs file during client teardownCVE-2026-68153 · Linux kernel libceph (per-client debugfs files vs client teardown)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-68257 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel sockmap: cork use-after-free when two threads send on the same socketCVE-2026-68284 · Linux kernel BPF sockmap (tcp_bpf_sendmsg cork handling)High