CVE-2026-64438

A flaw was found in the Linux kernel's crypto QAT (QuickAssist Technology) module. A race condition exists during the teardown of Virtual Function to Physical Function (VF2PF) work in the adf_disable_sriov() function. This allows a concurrently scheduled or already queued worker to attempt to access memory that has already been freed, leading to a use-after-free vulnerability. This can result in a null-pointer dereference, potentially causing system instability or crashes.

Red Hat has rated this vulnerability as having Moderate severity because exploitation requires local access and is constrained to systems equipped with Intel QuickAssist Technology (QAT) hardware running SR-IOV virtualization. The flaw occurs during the deactivation of virtual functions, where race conditions in inter-function communication teardown can cause kernel memory corruption or a denial of service. Systems without supported Intel QAT hardware or those that do not utilize SR-IOV with virtual functions are not exposed to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.