---
id: CVE-2026-64305
title: 'crypto: qat - protect service table iterations with service_lock'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  crypto: qat - protect service table iterations with service_lock

  The service_table list is protected by service_lock when entries are
  added or removed (in adf_service_…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d8cba25d2c68992a6e7c1d329b690a9ebe01167d <
    11d48f777cf8fad00db044f4c15cdf821427746b
  - >-
    Linux >= d8cba25d2c68992a6e7c1d329b690a9ebe01167d <
    222fa7b453b612f4407f260146d89a2ce2bc831d
  - >-
    Linux >= d8cba25d2c68992a6e7c1d329b690a9ebe01167d <
    c3c5925791cff3b84d313293fd60f384d877d793
  - >-
    Linux >= d8cba25d2c68992a6e7c1d329b690a9ebe01167d <
    0dbcecea740d943002c1cbdafa39bdfc108e32a5
  - >-
    Linux >= d8cba25d2c68992a6e7c1d329b690a9ebe01167d <
    5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e
  - Linux 3.17
published: '2026-07-25'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:43:14.502Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64305'
references:
  - url: 'https://git.kernel.org/stable/c/11d48f777cf8fad00db044f4c15cdf821427746b'
  - url: 'https://git.kernel.org/stable/c/222fa7b453b612f4407f260146d89a2ce2bc831d'
  - url: 'https://git.kernel.org/stable/c/c3c5925791cff3b84d313293fd60f384d877d793'
  - url: 'https://git.kernel.org/stable/c/0dbcecea740d943002c1cbdafa39bdfc108e32a5'
  - url: 'https://git.kernel.org/stable/c/5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e'
tags:
  - cve.org
epss: 0.00125
epssPercentile: 0.02002
ingestedAt: '2026-10-21T12:48:53.608Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

crypto: qat - protect service table iterations with service_lock

The service_table list is protected by service_lock when entries are
added or removed (in adf_service_add() and adf_service_remove()), but
several functions iterate over the list without holding this lock.

A concurrent adf_service_register() or adf_service_unregister() call
could modify the list during traversal, leading to list corruption or
a use-after-free.

Fix this by holding service_lock across all list_for_each_entry()
iterations of service_table in adf_dev_init(), adf_dev_start(),
adf_dev_stop(), adf_dev_shutdown(), adf_dev_restarting_notify(),
adf_dev_restarted_notify(), and adf_error_notifier().

The lock ordering is safe: callers of the static helpers (adf_dev_up()
and adf_dev_down()) acquire state_lock before service_lock, and no
event_hld callback or service_lock holder ever acquires state_lock in
the reverse order.

## Affected

- `Linux >= d8cba25d2c68992a6e7c1d329b690a9ebe01167d < 11d48f777cf8fad00db044f4c15cdf821427746b`
- `Linux >= d8cba25d2c68992a6e7c1d329b690a9ebe01167d < 222fa7b453b612f4407f260146d89a2ce2bc831d`
- `Linux >= d8cba25d2c68992a6e7c1d329b690a9ebe01167d < c3c5925791cff3b84d313293fd60f384d877d793`
- `Linux >= d8cba25d2c68992a6e7c1d329b690a9ebe01167d < 0dbcecea740d943002c1cbdafa39bdfc108e32a5`
- `Linux >= d8cba25d2c68992a6e7c1d329b690a9ebe01167d < 5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e`
- `Linux 3.17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.