CVE-2026-64438

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the crypto: qat component due to a race condition during VF2PF work teardown. The adf disable sriov() function destroys per-VF mutexes and frees the vf info structure without stopping new VF2PF work or ensuring that in-flight workers have completed. Consequently, a concurrently scheduled or already queued worker may dereference the freed memory. This issue involves the adf disable sriov() function and the vf info variable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.