CVE-2026-93162

A flaw was found in the Linux kernel's QAT (QuickAssist Technology) driver. When re-enabling SR-IOV (Single Root I/O Virtualization), the QAT reset worker queues a work item using data allocated on the stack. If a timeout occurs during this process, the reset worker can return while the work item, backed by the now-unwound stack frame, is still held or being executed. This can lead to a use-after-free condition, potentially causing system instability or a denial of service.

A use-after-return risk exists in the Intel QAT reset path because a SR-IOV reenable work item uses work_struct and completion data embedded in an on-stack adf_sriov_dev_data object. If the completion wait times out, the reset worker can return while device_sriov_wq still holds or executes the stack backed work item, leaving the queued work with a pointer into an invalid stack frame. This can lead to kernel memory corruption or a kernel crash during QAT PF reset or SR-IOV recovery. For the CVSS the PR:L is used for the paranoid score because some deployments may delegate accelerator access or reset influence to local service accounts, containers, or VF workloads rather than only full host administrators. The issue is not directly network reachable. Impact is at least local denial of service via kernel crash, and in the worst case may allow confidentiality or integrity impact due to stack use-after-return memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.