Cloudanix VulnDB

CVE-2026-93162

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux support for certain hardware acceleration cards can let attackers crash the system or run harmful code with deep system access.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in the QAT driver where an on-stack work_struct and completion for SR-IOV re-enable remain referenced by device_sriov_wq after the reset worker returns on timeout, allowing access to freed stack memory.

Why it matters to the business

Linux systems using Intel QAT hardware may suffer kernel instability, crashes, or memory corruption that disrupts hardware-accelerated crypto operations and can lead to denial of service or elevated code execution.

How an attack unfolds

An attacker triggers a timeout during SR-IOV re-enable on a QAT device so the reset worker exits while the work queue still holds or runs the stack-backed item, resulting in use-after-free memory corruption that can be leveraged for kernel-level attacks.

How to fix it

Apply the upstream kernel patch that cancels the SR-IOV re-enable work item on the device_sriov_wq before the stack frame unwinds on timeout.

How to confirm the fix worked

Confirm the fix is present by inspecting the QAT driver source for the added cancel_work call on timeout in the reset worker path and test SR-IOV re-enable timeout scenarios.

Typical attack path

  1. Cause SR-IOV re-enable completion to time out on a QAT device
  2. Allow the reset worker to return without canceling the queued work item
  3. Access the now-freed stack memory via the still-active work_struct
  4. Corrupt kernel memory to achieve code execution or denial of service

How to detect it

Review kernel logs for QAT-related reset worker timeouts and device_sriov_wq activity; correlate with unexpected crashes or memory corruption reports in the crypto/qat subsystem.

What your security team should do

  • Update to a kernel containing the QAT work-cancel fix
  • Disable SR-IOV on QAT devices if the feature is not required
  • Monitor kernel logs for QAT reset and work-queue timeout events

The record

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - cancel work on re-enable SR-IOV timeout The QAT reset worker queues SR-IOV reenable work using a work_struct and completion embedded in an on-stack adf_sriov_dev_data. If the completion wait times out, the reset worker can return while device_sriov_wq still holds or executes the stack-backed work item. Cancel the work on the device_sriov_wq on timeout before the stack frame unwinds.

Affected packages

Ecosystem Package Introduced Fixed