{"id":"CVE-2026-64305","title":"crypto: qat - protect service table iterations with service_lock","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - protect service table iterations with service_lock\n\nThe service_table list is protected by service_lock when entries are\nadded or removed (in adf_service_…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= d8cba25d2c68992a6e7c1d329b690a9ebe01167d < 11d48f777cf8fad00db044f4c15cdf821427746b","Linux >= d8cba25d2c68992a6e7c1d329b690a9ebe01167d < 222fa7b453b612f4407f260146d89a2ce2bc831d","Linux >= d8cba25d2c68992a6e7c1d329b690a9ebe01167d < c3c5925791cff3b84d313293fd60f384d877d793","Linux >= d8cba25d2c68992a6e7c1d329b690a9ebe01167d < 0dbcecea740d943002c1cbdafa39bdfc108e32a5","Linux >= d8cba25d2c68992a6e7c1d329b690a9ebe01167d < 5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e","Linux 3.17"],"published":"2026-07-25","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:43:14.502Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64305","references":[{"url":"https://git.kernel.org/stable/c/11d48f777cf8fad00db044f4c15cdf821427746b"},{"url":"https://git.kernel.org/stable/c/222fa7b453b612f4407f260146d89a2ce2bc831d"},{"url":"https://git.kernel.org/stable/c/c3c5925791cff3b84d313293fd60f384d877d793"},{"url":"https://git.kernel.org/stable/c/0dbcecea740d943002c1cbdafa39bdfc108e32a5"},{"url":"https://git.kernel.org/stable/c/5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e"}],"tags":["cve.org"],"epss":0.00125,"epssPercentile":0.02002,"ingestedAt":"2026-10-21T12:48:53.608Z","slug":"CVE-2026-64305","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - protect service table iterations with service_lock\n\nThe service_table list is protected by service_lock when entries are\nadded or removed (in adf_service_add() and adf_service_remove()), but\nseveral functions iterate over the list without holding this lock.\n\nA concurrent adf_service_register() or adf_service_unregister() call\ncould modify the list during traversal, leading to list corruption or\na use-after-free.\n\nFix this by holding service_lock across all list_for_each_entry()\niterations of service_table in adf_dev_init(), adf_dev_start(),\nadf_dev_stop(), adf_dev_shutdown(), adf_dev_restarting_notify(),\nadf_dev_restarted_notify(), and adf_error_notifier().\n\nThe lock ordering is safe: callers of the static helpers (adf_dev_up()\nand adf_dev_down()) acquire state_lock before service_lock, and no\nevent_hld callback or service_lock holder ever acquires state_lock in\nthe reverse order.\n\n## Affected\n\n- `Linux >= d8cba25d2c68992a6e7c1d329b690a9ebe01167d < 11d48f777cf8fad00db044f4c15cdf821427746b`\n- `Linux >= d8cba25d2c68992a6e7c1d329b690a9ebe01167d < 222fa7b453b612f4407f260146d89a2ce2bc831d`\n- `Linux >= d8cba25d2c68992a6e7c1d329b690a9ebe01167d < c3c5925791cff3b84d313293fd60f384d877d793`\n- `Linux >= d8cba25d2c68992a6e7c1d329b690a9ebe01167d < 0dbcecea740d943002c1cbdafa39bdfc108e32a5`\n- `Linux >= d8cba25d2c68992a6e7c1d329b690a9ebe01167d < 5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e`\n- `Linux 3.17`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}