Linux kernel QAT: use-after-free tearing down SR-IOV while VF2PF response work is in flight

Impact

adf_disable_sriov() destroys per-VF mutexes and frees struct adf_accel_vf_info without first stopping new VF2PF work or waiting for queued workers, so a worker on qat_pf2vf_resp_wq can dereference freed per-VF state on the host. That is host kernel memory corruption driven by activity from a virtual function - the side that is handed to a tenant when a QAT accelerator is shared by SR-IOV alongside GPUs on the same box. The KASAN trace in the record shows the crash in adf_gen4_pfvf_send() taking a mutex in freed memory. The scored vector is S:C, i.e. the flaw crosses the VF/host boundary. The window opens whenever SR-IOV is torn down: setting sriov_numvfs to 0, unbinding or reloading the driver, or a device reset.

Who can reach it

A local principal on the host with rights to disable SR-IOV (root, or automation doing a driver reload or reset) plus concurrent VF2PF traffic from a VF. A tenant holding a passed-through QAT VF supplies the racing side; the scored vector is AV:L/PR:L. Not reachable from the network and not reachable at all on hosts with no QAT device or no VFs configured.

What to do

Update to a stable kernel carrying the fix commits in the record and reload the intel_qat modules, which in practice means draining the node and rebooting since the VFs are in use by guests. Until then, avoid tearing down SR-IOV or resetting the QAT device while VFs are attached and passing traffic - the race only opens on that path, so scheduling teardown after guests are stopped removes the trigger. The record names commits, not a fixed release; check your distro advisory for the version.

References

Related entries

• Linux kernel (drivers/vfio/pci): If vfio-pci device registration fails after the device joined the VGA arbiter, theCVE-2026-64475 · Linux kernel (drivers/vfio/pci)High
• Linux kernel (arch/x86/kvm/mmu): If reclaiming shadow pages invalidates the root a fault is being serviced against, KVMCVE-2026-64561 · Linux kernel (arch/x86/kvm/mmu)High
• Linux kernel (arch/x86/kvm/vmx): Nested teardown freed the shadow VMCS page while vmcs01 still referenced it, andCVE-2026-64562 · Linux kernel (arch/x86/kvm/vmx)High
• Linux kernel (drivers/iommu/amd): Iommu_completion_wait() returned without waiting whenever another CPU had alreadyCVE-2026-68329 · Linux kernel (drivers/iommu/amd)High
• Linux kernel (net/xfrm): The rtnetlink changelink path for xfrm interfaces checked CAP_NET_ADMIN only against theCVE-2026-72136 · Linux kernel (net/xfrm)High
• Linux kernel (arch/x86/kvm): When KVM failed to program the interrupt remapping table for irq bypass, it left aCVE-2026-72283 · Linux kernel (arch/x86/kvm)High