CVE-2024-26974 in Linux
Summary
by MITRE • 05/01/2024
In the Linux kernel, the following vulnerability has been resolved:
crypto: qat - resolve race condition during AER recovery
During the PCI AER system's error recovery process, the kernel driver may encounter a race condition with freeing the reset_data structure's memory. If the device restart will take more than 10 seconds the function scheduling that restart will exit due to a timeout, and the reset_data structure will be freed. However, this data structure is used for completion notification after the restart is completed, which leads to a UAF bug.
This results in a KFENCE bug notice.
BUG: KFENCE: use-after-free read in adf_device_reset_worker+0x38/0xa0 [intel_qat]
Use-after-free read at 0x00000000bc56fddf (in kfence-#142): adf_device_reset_worker+0x38/0xa0 [intel_qat]
process_one_work+0x173/0x340
To resolve this race condition, the memory associated to the container of the work_struct is freed on the worker if the timeout expired, otherwise on the function that schedules the worker. The timeout detection can be done by checking if the caller is still waiting for completion or not by using completion_done() function.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 02/06/2026
The vulnerability CVE-2024-26974 affects the Linux kernel's implementation of the Quick Assist Technology (QAT) crypto driver, specifically addressing a race condition during PCI Advanced Error Reporting (AER) recovery processes. This issue resides within the intel_qat kernel module which manages hardware acceleration for cryptographic operations. The flaw manifests when the kernel attempts to restart a PCI device that has encountered an error, creating a timing window where memory management conflicts can occur. The vulnerability is categorized under CWE-362, which represents a race condition that can lead to security issues through improper synchronization of concurrent operations.
The technical implementation of this vulnerability occurs during the device reset process where the kernel driver schedules a work item to handle device restart operations. When the restart process exceeds a 10-second timeout period, the function responsible for scheduling the restart exits prematurely, causing the reset_data structure memory to be freed. However, this same memory structure is subsequently referenced in completion notification mechanisms after the restart completes, creating a use-after-free condition. The kernel's KFENCE subsystem detects this memory access violation and generates a bug notice indicating a use-after-free read at address 0x00000000bc56fddf, specifically within the adf_device_reset_worker function. This type of vulnerability represents a classic concurrency issue where the timing of memory deallocation conflicts with ongoing operations that depend on that memory.
The operational impact of CVE-2024-26974 extends beyond simple memory corruption, as it can potentially lead to system instability and denial of service conditions. Attackers could theoretically exploit this vulnerability to cause system crashes or potentially escalate privileges if they can manipulate the timing conditions to force memory corruption in a controlled manner. The vulnerability affects systems utilizing Intel QAT hardware acceleration, particularly those running Linux kernels with the intel_qat driver enabled. This issue falls under the ATT&CK technique T1068, which involves exploiting vulnerabilities in legitimate programs, and specifically relates to privilege escalation through kernel memory corruption. The race condition impacts the reliability of cryptographic operations and could compromise the security of systems relying on hardware-accelerated encryption services.
The resolution for CVE-2024-26974 implements a proper synchronization mechanism to prevent the race condition by adjusting when memory cleanup occurs. The fix ensures that the reset_data structure memory is freed by the worker function itself if the timeout expires, rather than by the scheduling function. This approach leverages the completion_done() function to determine whether the caller is still awaiting completion, thereby preventing premature memory deallocation. The mitigation strategy addresses the root cause by ensuring proper lifecycle management of the reset_data container, which contains the work_struct. This solution aligns with best practices for kernel memory management and concurrency control, preventing the use-after-free scenario that would otherwise occur. The fix represents a defensive programming approach that properly handles the timing dependencies between asynchronous operations and memory resource management in kernel space. Systems administrators should update to kernel versions containing this fix to prevent potential exploitation and maintain the integrity of cryptographic operations relying on QAT hardware acceleration.