CVE-2024-26974

What it actually does

Race condition during PCI AER recovery in Linux kernel QAT driver allows use-after-free read of reset_data structure in adf_device_reset_worker when restart exceeds 10-second timeout.

Why it matters to the business

Kernel instability or crashes on systems using Intel QAT hardware, with potential for local privilege escalation; high prevalence in Linux environments increases exposure across server and cloud fleets.

How an attack unfolds

Local attacker triggers PCI AER error recovery on Intel QAT device; if device restart exceeds timeout the scheduling function frees reset_data while the worker still references it for completion notification, resulting in use-after-free.

How to fix it

Update Linux kernel to commit daba62d9eeddcc5b1081be7d348ca836c83c59d7 or equivalent stable branch containing the fix that frees reset_data on the worker when timeout occurs or uses completion_done() check.

How to confirm the fix worked

Confirm kernel source or package includes daba62d9eeddcc5b1081be7d348ca836c83c59d7; reproduce AER recovery and verify absence of KFENCE use-after-free reports in dmesg.

Typical attack path

1. Obtain local access on target system with Intel QAT
2. Induce PCI AER error recovery condition
3. Force device restart to exceed 10-second timeout
4. Trigger reference to freed reset_data in adf_device_reset_worker

How to detect it

Search kernel logs and dmesg for KFENCE use-after-free notices referencing adf_device_reset_worker and intel_qat module; correlate with PCI AER recovery events.

• BUG: KFENCE: use-after-free read in adf_device_reset_worker+0x38/0xa0 [intel_qat]
• adf_device_reset_worker
• Use-after-free read at 0x00000000bc56fddf

What your security team should do

• Prioritize kernel upgrade on all systems exposing Intel QAT
• Enable KFENCE and monitor logs for related UAF reports
• Restrict local access where QAT devices are present until patched