Skip to main content

Linux Kernel EUVDEUVD-2026-49017

| CVE-2026-64305 HIGH
Use After Free (CWE-416)
2026-07-25 Linux GHSA-rf9w-458j-7pqc
Information Disclosure Linux Use After Free Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Race condition narrows the reliable trigger window, warranting AC:H; AV:L and PR:L confirmed by local driver access requirement with no elevated privileges.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Sep 03, 2026 - 18:16 vuln.today
CVSS changed
Sep 03, 2026 - 16:07 NVD
7.8 (HIGH)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:49 nvd
HIGH 7.8
CVE Published
Jul 25, 2026 - 08:49 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

crypto: qat - protect service table iterations with service_lock

The service_table list is protected by service_lock when entries are added or removed (in adf_service_add() and adf_service_remove()), but several functions iterate over the list without holding this lock.

A concurrent adf_service_register() or adf_service_unregister() call could modify the list during traversal, leading to list corruption or a use-after-free.

Fix this by holding service_lock across all list_for_each_entry() iterations of service_table in adf_dev_init(), adf_dev_start(), adf_dev_stop(), adf_dev_shutdown(), adf_dev_restarting_notify(), adf_dev_restarted_notify(), and adf_error_notifier().

The lock ordering is safe: callers of the static helpers (adf_dev_up() and adf_dev_down()) acquire state_lock before service_lock, and no event_hld callback or service_lock holder ever acquires state_lock in the reverse order.

AnalysisAI

Use-after-free and list corruption in the Linux kernel's Intel QuickAssist Technology (QAT) crypto driver allows a local low-privileged attacker to trigger kernel memory corruption by racing concurrent service registration and device lifecycle operations. The crypto/qat subsystem's service_table linked list is guarded by service_lock only during insertions and deletions, but seven device-state functions iterate the list unprotected, enabling a concurrent adf_service_register() or adf_service_unregister() call to mutate the list mid-traversal. Exploiting this race can result in kernel crash, arbitrary kernel memory read, or local privilege escalation to root. No public exploit code has been identified and EPSS stands at 0.21% (11th percentile), but the impact class is high for systems running QAT-capable Intel hardware.

Technical ContextAI

Intel QuickAssist Technology (QAT) is an offload engine for symmetric and asymmetric cryptography integrated into Intel Xeon/Atom server-class CPUs and discrete PCIe accelerators, exposed via the Linux kernel's crypto/qat subsystem. The driver maintains a global service_table as a linked list of registered service drivers (e.g. symmetric crypto, compression). Service registration (adf_service_add/remove, called from adf_service_register/unregister) correctly holds service_lock, but the device lifecycle paths adf_dev_init(), adf_dev_start(), adf_dev_stop(), adf_dev_shutdown(), adf_dev_restarting_notify(), adf_dev_restarted_notify(), and adf_error_notifier() all traverse the list via list_for_each_entry() without acquiring the lock. CWE-416 (Use After Free) applies because a concurrent unregister can free a list node while a traversal dereferences it; CWE-662 (improper synchronization) is the root cause. The fix adds service_lock acquisition around every list_for_each_entry() call in these paths, with the lock ordering documented as state_lock → service_lock (already consistent with existing callers adf_dev_up() and adf_dev_down()).

RemediationAI

Upgrade to a fixed kernel release: Linux 6.12.96, 6.18.39, or 7.1.4 in the respective stable trees, or any build based on Linux 7.2-rc1 or later mainline. Upstream commits for each stable branch are publicly available at the referenced git.kernel.org stable tree links. Where an immediate kernel upgrade is not possible, the most targeted compensating control is to prevent loading of the QAT driver module: add 'install qat_dh895xcc /bin/false' (and equivalent lines for other QAT PF/VF modules such as qat_c62x, qat_4xxx) to /etc/modprobe.d/qat-disable.conf. This eliminates the attack surface entirely at the cost of losing hardware crypto acceleration on affected devices, which may impact throughput-sensitive workloads relying on offloaded TLS or IPsec. Alternatively, restrict local shell or sudo access on hosts with QAT hardware to trusted operator accounts until the kernel upgrade is applied.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.208 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.184 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.218 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.186 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.237 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.180 Affected
SUSE Linux Enterprise Real Time 15 SP7 SUSE Real Time Module 15 SP7 Fixed
SUSE Linux Micro 6.0 Fixed

Share

EUVD-2026-49017 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy