CVE-2026-64529
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: crypto: qat - remove unused character device and IOCTLs The QAT driver exposes a character device (qat_adf_ctl) with IOCTLs for device configuration, start, stop, status query and enumeration. These IOCTLs are not part of any public uAPI header and have no known in-tree or out-of-tree users. Device lifecycle is already managed via sysfs. The ioctl interface also increases the attack surface and is the subject of a number of bug reports. Remove the character device, the IOCTL definitions, and the related data structures (adf_dev_status_info, adf_user_cfg_key_val, adf_user_cfg_section, adf_user_cfg_ctl_data). Drop the now-unused adf_cfg_user.h header and strip adf_ctl_drv.c down to the minimal module_init/module_exit hooks for workqueue, AER, and crypto/compression algorithm registration. Clean up leftover dead code that was only reachable from the removed IOCTL paths: adf_cfg_del_all(), adf_devmgr_verify_id(), adf_devmgr_get_num_dev(), adf_devmgr_get_dev_by_id(), adf_get_vf_real_id() and the unused ADF_CFG macros. Additionally, drop the entry associated to QAT IOCTLs in ioctl-number.rst.
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-07-25 10:17:39.317000
Last modified
2026-10-24 13:10:00.147000
View original CVE JSON
{
"id": "CVE-2026-64529",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-07-25T10:17:39.317",
"lastModified": "2026-10-24T13:10:00.147",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - remove unused character device and IOCTLs\n\nThe QAT driver exposes a character device (qat_adf_ctl) with IOCTLs\nfor device configuration, start, stop, status query and enumeration.\nThese IOCTLs are not part of any public uAPI header and have no known\nin-tree or out-of-tree users. Device lifecycle is already managed via\nsysfs.\n\nThe ioctl interface also increases the attack surface and is the\nsubject of a number of bug reports.\n\nRemove the character device, the IOCTL definitions, and the related\ndata structures (adf_dev_status_info, adf_user_cfg_key_val,\nadf_user_cfg_section, adf_user_cfg_ctl_data). Drop the now-unused\nadf_cfg_user.h header and strip adf_ctl_drv.c down to the minimal\nmodule_init/module_exit hooks for workqueue, AER, and crypto/compression\nalgorithm registration.\n\nClean up leftover dead code that was only reachable from the removed\nIOCTL paths: adf_cfg_del_all(), adf_devmgr_verify_id(),\nadf_devmgr_get_num_dev(), adf_devmgr_get_dev_by_id(),\nadf_get_vf_real_id() and the unused ADF_CFG macros.\n\nAdditionally, drop the entry associated to QAT IOCTLs in\nioctl-number.rst."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncrypto: qat - eliminar dispositivo de caracteres y IOCTLs no utilizados\n\nEl controlador QAT expone un dispositivo de caracteres (qat_adf_ctl) con IOCTLs para configuración de dispositivo, inicio, detención, consulta de estado y enumeración. Estos IOCTLs no forman parte de ningún encabezado uAPI público y no tienen usuarios conocidos dentro o fuera del árbol. El ciclo de vida del dispositivo ya se gestiona a través de sysfs.\n\nLa interfaz ioctl también aumenta la superficie de ataque y es objeto de varios informes de errores.\n\nEliminar el dispositivo de caracteres, las definiciones de IOCTL y las estructuras de datos relacionadas (adf_dev_status_info, adf_user_cfg_key_val, adf_user_cfg_section, adf_user_cfg_ctl_data). Eliminar el encabezado adf_cfg_user.h ahora no utilizado y reducir adf_ctl_drv.c a los ganchos mínimos module_init/module_exit para el registro de workqueue, AER y algoritmos de criptografía/compresión.\n\nLimpiar el código muerto restante que solo era accesible desde las rutas de IOCTL eliminadas: adf_cfg_del_all(), adf_devmgr_verify_id(), adf_devmgr_get_num_dev(), adf_devmgr_get_dev_by_id(), adf_get_vf_real_id() y las macros ADF_CFG no utilizadas.\n\nAdemás, eliminar la entrada asociada a los IOCTLs de QAT en ioctl-number.rst."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"Documentation/userspace-api/ioctl/ioctl-number.rst",
"drivers/crypto/intel/qat/qat_common/adf_cfg.c",
"drivers/crypto/intel/qat/qat_common/adf_cfg.h",
"drivers/crypto/intel/qat/qat_common/adf_cfg_common.h",
"drivers/crypto/intel/qat/qat_common/adf_cfg_user.h",
"drivers/crypto/intel/qat/qat_common/adf_common_drv.h",
"drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c",
"drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
"lessThan": "071590a44cbc38483fceb1ab943363ec26868e1b",
"versionType": "git",
"status": "affected"
},
{
"version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
"lessThan": "1de076f43e64bf65fbe7280a269c70e0e60518df",
"versionType": "git",
"status": "affected"
},
{
"version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
"lessThan": "a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a",
"versionType": "git",
"status": "affected"
},
{
"version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
"lessThan": "6848a6e39cac44fdb7cb88f0f777df62172d1551",
"versionType": "git",
"status": "affected"
},
{
"version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
"lessThan": "b1ea97076bd0a5196290deba172034e480646727",
"versionType": "git",
"status": "affected"
},
{
"version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
"lessThan": "b8ebf008696de1ec08c90d51f94d7e40bd448be1",
"versionType": "git",
"status": "affected"
},
{
"version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
"lessThan": "de2cc38489b629927910b1aeff69bba7bd5c6f1b",
"versionType": "git",
"status": "affected"
},
{
"version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
"lessThan": "3ae49dd04dbb11fb73f17f58a982dba128abe83a",
"versionType": "git",
"status": "affected"
},
{
"version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
"lessThan": "d237230728c567297f2f98b425d63156ab2ed17f",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"Documentation/userspace-api/ioctl/ioctl-number.rst",
"drivers/crypto/intel/qat/qat_common/adf_cfg.c",
"drivers/crypto/intel/qat/qat_common/adf_cfg.h",
"drivers/crypto/intel/qat/qat_common/adf_cfg_common.h",
"drivers/crypto/intel/qat/qat_common/adf_cfg_user.h",
"drivers/crypto/intel/qat/qat_common/adf_common_drv.h",
"drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c",
"drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "3.17",
"status": "affected"
},
{
"version": "0",
"lessThan": "3.17",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.260",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.211",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.177",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.144",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.95",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.37",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.0.14",
"lessThanOrEqual": "7.0.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.1.2",
"lessThanOrEqual": "7.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-16T15:41:41.952211Z",
"id": "CVE-2026-64529",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-489"
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/071590a44cbc38483fceb1ab943363ec26868e1b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1de076f43e64bf65fbe7280a269c70e0e60518df",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3ae49dd04dbb11fb73f17f58a982dba128abe83a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6848a6e39cac44fdb7cb88f0f777df62172d1551",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b1ea97076bd0a5196290deba172034e480646727",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b8ebf008696de1ec08c90d51f94d7e40bd448be1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d237230728c567297f2f98b425d63156ab2ed17f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/de2cc38489b629927910b1aeff69bba7bd5c6f1b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}