CVE-2026-64305

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> crypto: qat - protect service table iterations with service_lock<br /> <br /> The service_table list is protected by service_lock when entries are<br /> added or removed (in adf_service_add() and adf_service_remove()), but<br /> several functions iterate over the list without holding this lock.<br /> <br /> A concurrent adf_service_register() or adf_service_unregister() call<br /> could modify the list during traversal, leading to list corruption or<br /> a use-after-free.<br /> <br /> Fix this by holding service_lock across all list_for_each_entry()<br /> iterations of service_table in adf_dev_init(), adf_dev_start(),<br /> adf_dev_stop(), adf_dev_shutdown(), adf_dev_restarting_notify(),<br /> adf_dev_restarted_notify(), and adf_error_notifier().<br /> <br /> The lock ordering is safe: callers of the static helpers (adf_dev_up()<br /> and adf_dev_down()) acquire state_lock before service_lock, and no<br /> event_hld callback or service_lock holder ever acquires state_lock in<br /> the reverse order.