CVE-2026-64438

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()<br /> <br /> The VF2PF interrupt handler queues PF-side response work that stores a<br /> raw pointer to per-VF state (struct adf_accel_vf_info). Currently,<br /> adf_disable_sriov() destroys per-VF mutexes and frees vf_info without<br /> stopping new VF2PF work or waiting for in-flight workers to complete. A<br /> concurrently scheduled or already queued worker can then dereference<br /> freed memory.<br /> <br /> This manifests as a use-after-free when KASAN is enabled:<br /> <br /> BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0<br /> Write of size 8 at addr 0000000000000260 by task kworker/24:2/...<br /> Workqueue: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat]<br /> Call Trace:<br /> kasan_report+0x119/0x140<br /> mutex_lock+0x76/0xe0<br /> adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat]<br /> adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat]<br /> adf_iov_send_resp+0x8c/0xe0 [intel_qat]<br /> process_one_work+0x6ac/0xfd0<br /> worker_thread+0x4dd/0xd30<br /> kthread+0x326/0x410<br /> ret_from_fork+0x33b/0x670<br /> <br /> Add a PF-local flag, vf2pf_disabled, that gates work queueing, worker<br /> processing, and interrupt re-enabling during teardown. Set this flag<br /> atomically with the hardware interrupt mask inside<br /> adf_disable_all_vf2pf_interrupts(). After masking, synchronize the AE<br /> cluster MSI-X interrupt and flush the PF response workqueue before<br /> tearing down per-VF locks and state so all in-flight work completes<br /> before vf_info is destroyed.<br /> <br /> Introduce adf_enable_all_vf2pf_interrupts() to clear the flag and<br /> unmask all VF2PF interrupts under the same lock when SR-IOV is<br /> re-enabled. This ensures the software flag and hardware state transition<br /> atomically on both the enable and disable paths.