CVE-2026-64305 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
crypto: qat - protect service table iterations with service_lock
The service_table list is protected by service_lock when entries are added or removed (in adf_service_add() and adf_service_remove()), but several functions iterate over the list without holding this lock.
A concurrent adf_service_register() or adf_service_unregister() call could modify the list during traversal, leading to list corruption or a use-after-free.
Fix this by holding service_lock across all list_for_each_entry() iterations of service_table in adf_dev_init(), adf_dev_start(), adf_dev_stop(), adf_dev_shutdown(), adf_dev_restarting_notify(), adf_dev_restarted_notify(), and adf_error_notifier().
The lock ordering is safe: callers of the static helpers (adf_dev_up() and adf_dev_down()) acquire state_lock before service_lock, and no event_hld callback or service_lock holder ever acquires state_lock in the reverse order.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/25/2026
This vulnerability exists within the Linux kernel's Quick Assist Technology (QAT) cryptographic subsystem where improper locking mechanisms lead to potential race conditions during service table iterations. The qat crypto driver maintains a service_table list that contains registered services, and while the list is properly protected during insertion and removal operations through the service_lock mutex, several critical functions fail to maintain this lock during list traversal operations.
The technical flaw manifests when multiple threads attempt concurrent access to the service table structure. Specifically, functions such as adf_dev_init(), adf_dev_start(), adf_dev_stop(), adf_dev_shutdown(), adf_dev_restarting_notify(), adf_dev_restarted_notify(), and adf_error_notifier() perform list_for_each_entry() iterations without holding the service_lock mutex. This creates a window of vulnerability where another thread executing adf_service_register() or adf_service_unregister() can modify the list structure while it is being traversed, resulting in memory corruption or use-after-free conditions that could potentially lead to system instability or privilege escalation.
The operational impact of this vulnerability spans across multiple kernel subsystems and could affect systems utilizing QAT acceleration for cryptographic operations. Attackers with local privileges could exploit this race condition to cause system crashes through memory corruption or potentially escalate privileges by manipulating the service table structure during concurrent access scenarios. The vulnerability particularly affects systems running Linux kernels with QAT support where cryptographic operations are performed using hardware acceleration, making it relevant to enterprise security infrastructure and cloud computing environments that rely on hardware-accelerated cryptography.
The fix implements a comprehensive locking strategy that ensures service_lock is held throughout all list traversal operations in the affected functions. This approach follows established kernel concurrency patterns and maintains proper lock ordering principles where state_lock is acquired before service_lock during helper function calls, preventing potential deadlock scenarios. The solution aligns with common security practices outlined in the Common Weakness Enumeration framework under CWE-362, which addresses concurrent execution issues that can lead to race conditions and memory corruption vulnerabilities.
The mitigation strategy directly addresses the root cause by ensuring consistent lock acquisition during all service table iterations while maintaining the existing architectural patterns. This approach prevents list corruption scenarios that could occur during concurrent registration and unregistration operations, thereby maintaining system stability and security integrity. The fix demonstrates adherence to kernel security best practices as referenced in ATT&CK framework domain categories related to privilege escalation and system compromise through memory corruption vulnerabilities. The implementation preserves existing functionality while strengthening the concurrency model to prevent the specific race condition that could lead to unauthorized access or system instability in cryptographic processing environments utilizing QAT hardware acceleration.