EUVD-2026-59453
GHSA-5q42-qm7h-h2q2
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition exploitation requires precise kernel-level timing to win the TOCTOU window, warranting AC:H over the vendor-assigned AC:L; PR:L reflects required local low-privilege access to the VFIO migration file interface.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
vfio/qat: fix f_pos race in qat_vf_resume_write()
qat_vf_resume_write() checks filp->f_pos before taking migf->lock, but copies into the migration-state buffer after taking the lock and re-reading the shared file position.
Two concurrent writers could therefore pass the bounds check with the old offset, then have the second writer copy after the first advanced f_pos, writing past the end of the migration-state buffer.
Take migf->lock before doing the boundary checks.
AnalysisAI
Out-of-bounds write in the Linux kernel's vfio/qat driver allows a local low-privileged user with access to the Intel QuickAssist Technology virtual function migration interface to corrupt kernel memory through a race condition. The root cause is a Time-of-Check Time-of-Use flaw in qat_vf_resume_write(), where two concurrent writers can both pass the filp->f_pos boundary check before the lock is held, causing the second writer to copy data past the end of the migration-state buffer once the first writer has already advanced the file position. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) local code execution on the target host with at minimum low-privilege user access (CVSS PR:L confirmed) - remote exploitation without prior local foothold is not possible given AV:L; (2) Intel QuickAssist Technology (QAT) hardware physically present in the host with SR-IOV virtual functions configured; (3) the vfio/qat kernel module loaded and a QAT virtual function exposed through the VFIO migration file interface; (4) the ability to open the QAT VF migration file and issue concurrent write() calls - this is typically accessible only to processes involved in VM live migration management; (5) successfully winning a kernel-level timing race between two concurrent writers within the TOCTOU window in qat_vf_resume_write(). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects full kernel-compromise potential upon successful exploitation, but AC:L is arguably optimistic for a write-write race condition - reliably winning kernel-level timing races typically requires environmental staging, repeated attempts, or auxiliary primitives, which this analyst rates as AC:H in practice. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with low-privilege code execution on a hypervisor host running Intel QAT hardware with VFIO virtual function passthrough enabled opens the QAT VF migration file interface and spawns two concurrent threads that both issue write() calls simultaneously. Both threads observe the unadvanced f_pos, pass the boundary check, and then serialize under migf->lock - at which point the second thread writes at an already-advanced offset, placing data beyond the end of the migration-state buffer into adjacent kernel memory. … |
| Remediation | Upgrade to a vendor-released patched stable kernel: Linux 6.12.97, Linux 6.18.40, or Linux 7.1.5 (or any later release in the respective stable series), or track the 7.2-rc1 pre-release line. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your Linux systems inventory to identify instances running unpatched kernel versions and verify whether Intel QuickAssist Technology is enabled or in use; prioritize systems with QAT acceleration active. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today