CVE-2026-64438

In the Linux kernel, the following vulnerability has been resolved:

crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()

The VF2PF interrupt handler queues PF-side response work that stores a

raw pointer to per-VF state (struct adf_accel_vf_info). Currently,

adf_disable_sriov() destroys per-VF mutexes and frees vf_info without

stopping new VF2PF work or waiting for in-flight workers to complete. A

concurrently scheduled or already queued worker can then dereference

freed memory.

This manifests as a use-after-free when KASAN is enabled:

BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0

Write of size 8 at addr 0000000000000260 by task kworker/24:2/...

Workqueue: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat]

Call Trace:

kasan_report+0x119/0x140

mutex_lock+0x76/0xe0

adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat]

adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat]

adf_iov_send_resp+0x8c/0xe0 [intel_qat]

process_one_work+0x6ac/0xfd0

worker_thread+0x4dd/0xd30

kthread+0x326/0x410

ret_from_fork+0x33b/0x670

Add a PF-local flag, vf2pf_disabled, that gates work queueing, worker

processing, and interrupt re-enabling during teardown. Set this flag

atomically with the hardware interrupt mask inside

adf_disable_all_vf2pf_interrupts(). After masking, synchronize the AE

cluster MSI-X interrupt and flush the PF response workqueue before

tearing down per-VF locks and state so all in-flight work completes

before vf_info is destroyed.

Introduce adf_enable_all_vf2pf_interrupts() to clear the flag and

unmask all VF2PF interrupts under the same lock when SR-IOV is

re-enabled. This ensures the software flag and hardware state transition

atomically on both the enable and disable paths.