CVE-2025-39721:

A use-after-free vulnerability in the Linux kernel's QAT driver can lead to kernel crashes during repeated device loading and unloading.

Score
A numerical rating that indicates how dangerous this vulnerability is.

5.5Medium

Published Date:Sep 5, 2025
CISA KEV Date:*No Data*
Industries Affected:20

Threat Predictions

EPSS Score:0.0
EPSS Percentile:5%

Exploitability

Score:1.8
Attack Vector:LOCAL
Attack Complexity:LOW
Privileges Required:LOW
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:3.6
Confidentiality Impact:NONE
Integrity Impact:NONE
Availability Impact:HIGH

Description Preview

A use-after-free vulnerability in the Linux kernel's QAT driver can lead to kernel crashes during repeated device loading and unloading.

Overview

The vulnerability arises from the interaction between device-specific QAT drivers (e.g., qat_4xxx) and the core intel_qat driver. When a power management interrupt occurs just before the device-specific driver is unloaded, a deferred routine may remain pending in the shared workqueue (qat_misc_wq). If this routine executes after the driver is unloaded, it can access freed memory, resulting in a page fault and kernel crash. This issue is particularly problematic in scenarios involving rapid loading and unloading of QAT drivers, which may occur in certain testing or dynamic reconfiguration environments.

Remediation

To address this vulnerability, the Linux kernel has implemented a fix that flushes the misc workqueue during device shutdown. This ensures that all pending work items are completed before the driver is unloaded, preventing the use-after-free scenario. Users and administrators should update their Linux kernel to a patched version:
1. For kernel series 5.18 to 6.6, update to version 6.6.103 or later.
2. For kernel series 6.7 to 6.12, update to version 6.12.44 or later.
3. For kernel series 6.13 to 6.16, update to version 6.16.4 or later.
It's important to note that while this fix may slightly increase shutdown latency if the workqueue contains jobs from other devices, it ensures system stability and prevents potential crashes.