Linux Kernel EUVD-2026-49017

Exploitation requires: (1) a local account with the ability to execute unprivileged code on the target system (PR:L - no root or special capabilities needed beyond basic shell access); (2) Intel QuickAssist Technology (QAT) hardware physically present in the host (PCIe QAT accelerator card or server-class Intel Xeon/Atom with integrated QAT) and the kernel's adf driver module loaded; (3) the ability to trigger concurrent service register/unregister and device lifecycle events - achievable via normal user space calls or by inducing a QAT device error. There is no network attack vector; the entire exploit chain runs locally. The race window is narrow and may require repeated attempts, raising practical complexity above the AC:L rating suggests. Systems without QAT hardware, or with the qat kernel module explicitly blocklisted, are entirely unexploitable.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8 and reflects a realistic worst-case: a local process with low privileges races the kernel's QAT device lifecycle, achieves UAF, and escalates to root or crashes the host. The AC:L rating may be slightly generous for a race condition - triggering reliable list corruption typically requires repeated concurrent attempts - but kernel UAF races are well-understood attack primitives and tooling exists to win them. EPSS at 0.21%/11th percentile and the absence of KEV listing indicate no observed active exploitation. No public PoC has been identified. The hardware prerequisite (Intel QAT device must be present and the adf driver loaded) limits the real-world attack surface to server/cloud environments - not commodity endpoints. For those environments, however, this is a genuine local privilege escalation path with high impact across all three security dimensions. Patched stable kernel versions are available, making the remediation straightforward.

A local attacker with a shell account on a server equipped with an Intel QAT accelerator spawns multiple threads - one repeatedly calling a service registration/unregistration path while another triggers a QAT device lifecycle transition (e.g., restarting the device via sysfs or causing an error event). The racing unregister frees a service_table node that the lifecycle function's list_for_each_entry() is currently dereferencing, yielding a use-after-free. The attacker leverages the corrupted kernel pointer to achieve arbitrary kernel read/write and ultimately privilege escalation to root. No public PoC has been identified, but kernel UAF-to-privesc is a well-practiced exploit class.