CVE-2026-64529 (GCVE-0-2026-64529)

Vulnerability from cvelistv5 – Published: 2026-07-25 09:24 – Updated: 2026-08-17 04:57
VLAI
Title
crypto: qat - remove unused character device and IOCTLs
Summary
In the Linux kernel, the following vulnerability has been resolved: crypto: qat - remove unused character device and IOCTLs The QAT driver exposes a character device (qat_adf_ctl) with IOCTLs for device configuration, start, stop, status query and enumeration. These IOCTLs are not part of any public uAPI header and have no known in-tree or out-of-tree users. Device lifecycle is already managed via sysfs. The ioctl interface also increases the attack surface and is the subject of a number of bug reports. Remove the character device, the IOCTL definitions, and the related data structures (adf_dev_status_info, adf_user_cfg_key_val, adf_user_cfg_section, adf_user_cfg_ctl_data). Drop the now-unused adf_cfg_user.h header and strip adf_ctl_drv.c down to the minimal module_init/module_exit hooks for workqueue, AER, and crypto/compression algorithm registration. Clean up leftover dead code that was only reachable from the removed IOCTL paths: adf_cfg_del_all(), adf_devmgr_verify_id(), adf_devmgr_get_num_dev(), adf_devmgr_get_dev_by_id(), adf_get_vf_real_id() and the unused ADF_CFG macros. Additionally, drop the entry associated to QAT IOCTLs in ioctl-number.rst.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d8cba25d2c68992a6e7c1d329b690a9ebe01167d , < 071590a44cbc38483fceb1ab943363ec26868e1b (git)
Affected: d8cba25d2c68992a6e7c1d329b690a9ebe01167d , < 1de076f43e64bf65fbe7280a269c70e0e60518df (git)
Affected: d8cba25d2c68992a6e7c1d329b690a9ebe01167d , < a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a (git)
Affected: d8cba25d2c68992a6e7c1d329b690a9ebe01167d , < 6848a6e39cac44fdb7cb88f0f777df62172d1551 (git)
Affected: d8cba25d2c68992a6e7c1d329b690a9ebe01167d , < b1ea97076bd0a5196290deba172034e480646727 (git)
Affected: d8cba25d2c68992a6e7c1d329b690a9ebe01167d , < b8ebf008696de1ec08c90d51f94d7e40bd448be1 (git)
Affected: d8cba25d2c68992a6e7c1d329b690a9ebe01167d , < de2cc38489b629927910b1aeff69bba7bd5c6f1b (git)
Affected: d8cba25d2c68992a6e7c1d329b690a9ebe01167d , < 3ae49dd04dbb11fb73f17f58a982dba128abe83a (git)
Affected: d8cba25d2c68992a6e7c1d329b690a9ebe01167d , < d237230728c567297f2f98b425d63156ab2ed17f (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.17
Unaffected: 0 , < 3.17 (semver)
Unaffected: 5.10.260 , ≤ 5.10.* (semver)
Unaffected: 5.15.211 , ≤ 5.15.* (semver)
Unaffected: 6.1.177 , ≤ 6.1.* (semver)
Unaffected: 6.6.144 , ≤ 6.6.* (semver)
Unaffected: 6.12.95 , ≤ 6.12.* (semver)
Unaffected: 6.18.37 , ≤ 6.18.* (semver)
Unaffected: 7.0.14 , ≤ 7.0.* (semver)
Unaffected: 7.1.2 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "Documentation/userspace-api/ioctl/ioctl-number.rst",
            "drivers/crypto/intel/qat/qat_common/adf_cfg.c",
            "drivers/crypto/intel/qat/qat_common/adf_cfg.h",
            "drivers/crypto/intel/qat/qat_common/adf_cfg_common.h",
            "drivers/crypto/intel/qat/qat_common/adf_cfg_user.h",
            "drivers/crypto/intel/qat/qat_common/adf_common_drv.h",
            "drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c",
            "drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "071590a44cbc38483fceb1ab943363ec26868e1b",
              "status": "affected",
              "version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
              "versionType": "git"
            },
            {
              "lessThan": "1de076f43e64bf65fbe7280a269c70e0e60518df",
              "status": "affected",
              "version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
              "versionType": "git"
            },
            {
              "lessThan": "a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a",
              "status": "affected",
              "version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
              "versionType": "git"
            },
            {
              "lessThan": "6848a6e39cac44fdb7cb88f0f777df62172d1551",
              "status": "affected",
              "version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
              "versionType": "git"
            },
            {
              "lessThan": "b1ea97076bd0a5196290deba172034e480646727",
              "status": "affected",
              "version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
              "versionType": "git"
            },
            {
              "lessThan": "b8ebf008696de1ec08c90d51f94d7e40bd448be1",
              "status": "affected",
              "version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
              "versionType": "git"
            },
            {
              "lessThan": "de2cc38489b629927910b1aeff69bba7bd5c6f1b",
              "status": "affected",
              "version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
              "versionType": "git"
            },
            {
              "lessThan": "3ae49dd04dbb11fb73f17f58a982dba128abe83a",
              "status": "affected",
              "version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
              "versionType": "git"
            },
            {
              "lessThan": "d237230728c567297f2f98b425d63156ab2ed17f",
              "status": "affected",
              "version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "Documentation/userspace-api/ioctl/ioctl-number.rst",
            "drivers/crypto/intel/qat/qat_common/adf_cfg.c",
            "drivers/crypto/intel/qat/qat_common/adf_cfg.h",
            "drivers/crypto/intel/qat/qat_common/adf_cfg_common.h",
            "drivers/crypto/intel/qat/qat_common/adf_cfg_user.h",
            "drivers/crypto/intel/qat/qat_common/adf_common_drv.h",
            "drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c",
            "drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.17"
            },
            {
              "lessThan": "3.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.260",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.260",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.211",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.177",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.37",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.14",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.2",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - remove unused character device and IOCTLs\n\nThe QAT driver exposes a character device (qat_adf_ctl) with IOCTLs\nfor device configuration, start, stop, status query and enumeration.\nThese IOCTLs are not part of any public uAPI header and have no known\nin-tree or out-of-tree users. Device lifecycle is already managed via\nsysfs.\n\nThe ioctl interface also increases the attack surface and is the\nsubject of a number of bug reports.\n\nRemove the character device, the IOCTL definitions, and the related\ndata structures (adf_dev_status_info, adf_user_cfg_key_val,\nadf_user_cfg_section, adf_user_cfg_ctl_data). Drop the now-unused\nadf_cfg_user.h header and strip adf_ctl_drv.c down to the minimal\nmodule_init/module_exit hooks for workqueue, AER, and crypto/compression\nalgorithm registration.\n\nClean up leftover dead code that was only reachable from the removed\nIOCTL paths: adf_cfg_del_all(), adf_devmgr_verify_id(),\nadf_devmgr_get_num_dev(), adf_devmgr_get_dev_by_id(),\nadf_get_vf_real_id() and the unused ADF_CFG macros.\n\nAdditionally, drop the entry associated to QAT IOCTLs in\nioctl-number.rst."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable interface is reached through local open and ioctl syscalls on /dev/qat_adf_ctl; it has no network or physical entry path.\nAC:L - The attacker can repeatedly invoke the start or status ioctl while coordinating QAT VF teardown in a hot-pluggable deployment, giving effective control over the race. A short ioctl loop has already produced the confirmed [KASAN use-after-free](https://www.spinics.net/lists/kernel/msg6034466.html ).\nPR:L - The driver performs no capability or credential check, so device-file permissions are the only gate. Standard QAT installation grants non-root qat-group members mode-0660 access to qat_adf_ctl according to the [Intel QAT installation guide](https://intel.github.io/quickassist/GSG/2.X/installation.html ).\nUI:N - Exploitation requires only attacker-generated ioctl calls and device-lifecycle operations, with no action by another user.\nS:U - The flaw compromises the same host or guest kernel security authority in which the vulnerable QAT driver executes; ordinary kernel privilege escalation does not change scope.\nC:H - The freed accel_dev can be reclaimed with attacker-influenced heap contents, and the status path follows stale pointers and invokes callbacks, providing a defensible route to arbitrary kernel-memory disclosure.\nI:H - Mutex operations and configuration paths write through the reclaimed object, while forged hw_device callbacks provide a plausible control-flow-hijack and arbitrary-kernel-write primitive.\nA:H - The UAF is confirmed to cause a KASAN kernel failure, and repeated malformed ioctls can independently create a printk storm leading to stalls, watchdog lockups, or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:57:06.789Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/071590a44cbc38483fceb1ab943363ec26868e1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/1de076f43e64bf65fbe7280a269c70e0e60518df"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a"
        },
        {
          "url": "https://git.kernel.org/stable/c/6848a6e39cac44fdb7cb88f0f777df62172d1551"
        },
        {
          "url": "https://git.kernel.org/stable/c/b1ea97076bd0a5196290deba172034e480646727"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8ebf008696de1ec08c90d51f94d7e40bd448be1"
        },
        {
          "url": "https://git.kernel.org/stable/c/de2cc38489b629927910b1aeff69bba7bd5c6f1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ae49dd04dbb11fb73f17f58a982dba128abe83a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d237230728c567297f2f98b425d63156ab2ed17f"
        }
      ],
      "title": "crypto: qat - remove unused character device and IOCTLs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64529",
    "datePublished": "2026-07-25T09:24:18.750Z",
    "dateReserved": "2026-07-19T15:36:31.794Z",
    "dateUpdated": "2026-08-17T04:57:06.789Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64529",
      "date": "2026-09-20",
      "epss": "0.00135",
      "percentile": "0.0334"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-27T14:44:27.000Z",
      "cve": "CVE-2026-64529",
      "id": "msrc_CVE-2026-64529",
      "initial_release_date": "2026-07-26T01:02:09.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "crypto: qat - remove unused character device and IOCTLs",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64529.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "Documentation/userspace-api/ioctl/ioctl-number.rst",
                  "drivers/crypto/intel/qat/qat_common/adf_cfg.c",
                  "drivers/crypto/intel/qat/qat_common/adf_cfg.h",
                  "drivers/crypto/intel/qat/qat_common/adf_cfg_common.h",
                  "drivers/crypto/intel/qat/qat_common/adf_cfg_user.h",
                  "drivers/crypto/intel/qat/qat_common/adf_common_drv.h",
                  "drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c",
                  "drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "071590a44cbc38483fceb1ab943363ec26868e1b",
                    "status": "affected",
                    "version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1de076f43e64bf65fbe7280a269c70e0e60518df",
                    "status": "affected",
                    "version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a",
                    "status": "affected",
                    "version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6848a6e39cac44fdb7cb88f0f777df62172d1551",
                    "status": "affected",
                    "version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b1ea97076bd0a5196290deba172034e480646727",
                    "status": "affected",
                    "version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b8ebf008696de1ec08c90d51f94d7e40bd448be1",
                    "status": "affected",
                    "version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "de2cc38489b629927910b1aeff69bba7bd5c6f1b",
                    "status": "affected",
                    "version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3ae49dd04dbb11fb73f17f58a982dba128abe83a",
                    "status": "affected",
                    "version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d237230728c567297f2f98b425d63156ab2ed17f",
                    "status": "affected",
                    "version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "Documentation/userspace-api/ioctl/ioctl-number.rst",
                  "drivers/crypto/intel/qat/qat_common/adf_cfg.c",
                  "drivers/crypto/intel/qat/qat_common/adf_cfg.h",
                  "drivers/crypto/intel/qat/qat_common/adf_cfg_common.h",
                  "drivers/crypto/intel/qat/qat_common/adf_cfg_user.h",
                  "drivers/crypto/intel/qat/qat_common/adf_common_drv.h",
                  "drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c",
                  "drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.17"
                  },
                  {
                    "lessThan": "3.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.260",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.211",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.177",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.144",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.95",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.37",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.14",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - remove unused character device and IOCTLs\n\nThe QAT driver exposes a character device (qat_adf_ctl) with IOCTLs\nfor device configuration, start, stop, status query and enumeration.\nThese IOCTLs are not part of any public uAPI header and have no known\nin-tree or out-of-tree users. Device lifecycle is already managed via\nsysfs.\n\nThe ioctl interface also increases the attack surface and is the\nsubject of a number of bug reports.\n\nRemove the character device, the IOCTL definitions, and the related\ndata structures (adf_dev_status_info, adf_user_cfg_key_val,\nadf_user_cfg_section, adf_user_cfg_ctl_data). Drop the now-unused\nadf_cfg_user.h header and strip adf_ctl_drv.c down to the minimal\nmodule_init/module_exit hooks for workqueue, AER, and crypto/compression\nalgorithm registration.\n\nClean up leftover dead code that was only reachable from the removed\nIOCTL paths: adf_cfg_del_all(), adf_devmgr_verify_id(),\nadf_devmgr_get_num_dev(), adf_devmgr_get_dev_by_id(),\nadf_get_vf_real_id() and the unused ADF_CFG macros.\n\nAdditionally, drop the entry associated to QAT IOCTLs in\nioctl-number.rst."
          }
        ],
        "id": "CVE-2026-64529",
        "lastModified": "2026-08-17T05:17:57.737",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-25T10:17:39.317",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/071590a44cbc38483fceb1ab943363ec26868e1b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1de076f43e64bf65fbe7280a269c70e0e60518df"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3ae49dd04dbb11fb73f17f58a982dba128abe83a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6848a6e39cac44fdb7cb88f0f777df62172d1551"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b1ea97076bd0a5196290deba172034e480646727"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b8ebf008696de1ec08c90d51f94d7e40bd448be1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d237230728c567297f2f98b425d63156ab2ed17f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/de2cc38489b629927910b1aeff69bba7bd5c6f1b"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-29T13:53:16+00:00",
      "cve": "CVE-2026-64529",
      "id": "CVE-2026-64529",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: crypto: qat - remove unused character device and IOCTLs",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64529.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:46:43Z",
      "cve": "CVE-2026-64529",
      "id": "CVE-2026-64529",
      "initial_release_date": "2026-07-25T15:57:40Z",
      "product_status:known_affected": "372",
      "product_status:known_not_affected": "4",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64529",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64529.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.