Linux kernel crypto/qat: unused qat_adf_ctl character device and IOCTLs removed as attack surface

CVSS 7.8CVE-2026-64529Firmware, BMC & network fabriccurated

Impact

The Intel QuickAssist driver exposed a qat_adf_ctl character device with IOCTLs for device configuration, start, stop, status query and enumeration. They are not part of any public uAPI header, have no known users, duplicate lifecycle control that sysfs already provides, and had attracted a series of bug reports; the fix deletes the device, the IOCTL definitions and the dead code reachable only from them. QAT offload cards sit in storage, compression and TLS-terminating datacenter servers, so the value here is removal of a privileged local control surface on those hosts rather than a single named memory-safety flaw - the record does not describe one.

Who can reach it

Local process able to open the qat_adf_ctl character device; reach depends on the device node permissions your distribution ships. Not remotely reachable.

What to do

Apply the stable kernel update for your series and reboot the node. If you cannot patch promptly, restrict permissions on the qat_adf_ctl device node - nothing in-tree depends on it, and device lifecycle is managed through sysfs.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-64529 https://git.kernel.org/stable/c/071590a44cbc38483fceb1ab943363ec26868e1b https://git.kernel.org/stable/c/1de076f43e64bf65fbe7280a269c70e0e60518df https://git.kernel.org/stable/c/3ae49dd04dbb11fb73f17f58a982dba128abe83a

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.