CVE-2026-74306

A flaw was found in the Linux kernel's vfio/qat driver. This vulnerability involves a race condition in the qat_vf_resume_write() function, where concurrent operations can bypass a critical bounds check. This allows data to be written beyond the intended memory area, potentially corrupting system memory. A local attacker could exploit this to cause a system crash (Denial of Service) or potentially gain elevated privileges.

qat_vf_resume_write() checked filp f_pos before taking migf lock, then copied user data into the VFIO/QAT migration state buffer after taking the lock and using the shared file position again. Two concurrent local writers can pass the bounds check with an old offset and then one writer can advance f_pos before the other copy, causing an out of bounds write past the migration state buffer. For the CVSS the PR:L is used because an attacker needs local access to the VFIO/QAT migration file or an equivalent VM management context, but this is not full host administrator privilege in many deployments. The issue is not network reachable. Impact is at least local denial of service via kernel memory corruption and in worst case may allow confidentiality or integrity impact due to a kernel out of bounds write.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.